CVE-2026-30863
Published: 07 March 2026
Summary
CVE-2026-30863 is a critical-severity Improper Authentication (CWE-287) vulnerability in Parseplatform Parse-Server. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and IA-13 (Identity Providers and Authorization Servers).
Deeper analysis
CVE-2026-30863 is a critical authentication vulnerability in Parse Server, an open source backend deployable on any Node.js-compatible infrastructure. In versions prior to 8.6.10 and 9.5.0-alpha.11, the Google, Apple, and Facebook authentication adapters perform JWT verification on identity tokens but silently skip validation of the audience claim when the relevant configuration option is unset—specifically, clientId for Google and Apple, or appIds for Facebook. This flaw, scored at CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and linked to CWEs 287 (Improper Authentication) and 863 (Incorrect Authorization), allows attackers to bypass intended application-specific restrictions.
A remote, unauthenticated attacker can exploit this vulnerability by obtaining a validly signed JWT issued for a different application via the same provider (Google, Apple, or Facebook) and submitting it to the target Parse Server. Successful exploitation enables the attacker to authenticate as any user on the server, granting unauthorized access to that user's data, privileges, and actions, with potential for complete compromise of confidentiality, integrity, and availability.
The vulnerability has been patched in Parse Server versions 8.6.10 and 9.5.0-alpha.11. Additional mitigation details and patch information are available in the GitHub security advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10172
Vulnerability details
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the…
more
adapter's audience configuration option is not set (clientId for Google/Apple, appIds for Facebook), JWT verification silently skips audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server. This issue has been patched in versions 8.6.10 and 9.5.0-alpha.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote exploitation of public-facing Parse Server auth bypass (T1190) via misuse of cross-app JWT access tokens (T1550.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific flaw in Parse Server's authentication adapters that skips JWT audience claim validation when configuration options are unset.
Enforces configuration settings requiring the audience configuration options (clientId for Google/Apple, appIds for Facebook) to be explicitly set, preventing the silent skip of JWT audience validation.
Requires proper management and security requirements for external identity providers like Google, Apple, and Facebook, including validation of JWT claims such as audience to ensure tokens are application-specific.