CVE-2026-27804

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27804
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27804.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27804
Aliases
Published
2026-02-25T23:48:20Z
Modified
2026-10-28T02:30:30Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
Details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with alg: "none" to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected RS256 algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with jwks-rsa which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-327",
        "CWE-345"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27804.json"
}
References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type
GIT
Repo
https://github.com/parse-community/parse-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9f28ff56639bbae54cd0beddd4b2eaf0fccd13f7
Introduced
532a461d30a6ed4457839f2caf5f30d5abf51a55
Fixed
5d94d2b83a3fc844f66993a418f4f0d336ea176e
Fixed
9b94083accb7f3e72c6b8126c195c7a03dd2dfd7
Fixed
9d5942d50e55c822924c27b05aa98f1393e7a330
Fixed
86f9ffd5a04a0c0dcba7f36a031e0f4c5d41256d
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "8.6.3"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "9.0.0"
                },
                {
                    "fixed": "9.3.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "9b94083accb7f3e72c6b8126c195c7a03dd2dfd7"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "9d5942d50e55c822924c27b05aa98f1393e7a330"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "8.6.3",
            "range": [
                {
                    "fixed": "9f28ff56639bbae54cd0beddd4b2eaf0fccd13f7"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "9.3.1-alpha.4",
            "range": [
                {
                    "fixed": "86f9ffd5a04a0c0dcba7f36a031e0f4c5d41256d"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.21
2.2.22
2.2.23
2.2.24
2.2.25
2.2.25-beta.1
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.8.0
2.8.2
3.*
3.0.0
3.1.0
3.1.1
3.1.2
3.1.3
3.10.0
3.2.0
3.2.1
3.2.2
3.2.3
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.7.2
3.8.0
3.9.0
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.2.0
4.3.0
4.4.0
4.5.0
5.*
5.0.0
5.0.0-alpha.1
5.1.0
5.1.1
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.3.0
5.3.1
5.3.2
5.3.3
5.4.0
6.*
6.0.0
6.1.0
6.2.0
6.2.1
6.2.2
6.3.0
6.3.1
6.4.0
7.*
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
8.*
8.0.0
8.0.1
8.0.2
8.1.0
8.2.0
8.2.1
8.2.2
8.2.3
8.2.4
8.2.5
8.3.0
8.4.0
8.5.0
8.6.0
8.6.1
8.6.2
9.*
9.0.0
9.1.0
9.1.1
9.2.0
9.3.0
9.3.1-alpha.1
9.3.1-alpha.2
9.3.1-alpha.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27804.json"