Raw vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-32242 is a critical-severity Race Condition (CWE-362) vulnerability in Parseplatform Parse-Server. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-32242 is a race condition vulnerability (CWE-362) in Parse Server, an open source backend deployable on any Node.js infrastructure. The issue affects the built-in OAuth2 authentication adapter, which exports a singleton instance reused across all OAuth2 provider configurations. In versions prior to 9.6.0-alpha.11 and 8.6.37, concurrent authentication requests for different OAuth2 providers can cause one provider's token validation to execute using another provider's configuration. This may allow a token that should be rejected by its intended provider to be accepted due to validation against a different provider's policy. Only deployments configuring multiple OAuth2 providers via the oauth2: true flag are affected. The vulnerability has a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
An attacker can exploit this vulnerability over the network without authentication privileges by timing concurrent authentication requests across multiple OAuth2 providers. Under race conditions, they could supply a token valid under one provider's lenient policy but intended for a stricter one, tricking the server into accepting it. Successful exploitation enables high-impact confidentiality and integrity violations, such as unauthorized access to user accounts or data by impersonating legitimate users.
The Parse Server security advisory (GHSA-2cjm-2gwv-m892) and release notes for versions 8.6.37 and 9.6.0-alpha.11 detail the fix, which addresses the singleton reuse issue in the OAuth2 adapter. Security practitioners should upgrade to Parse Server 9.6.0-alpha.11 or later (for the 9.x branch) or 8.6.37 or later (for the 8.x branch) and review configurations to ensure multiple OAuth2 providers are necessary, minimizing exposure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11677
Vulnerability Data
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2…
more
provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's configuration, potentially allowing a token that should be rejected by one provider to be accepted because it is validated against a different provider's policy. Deployments that configure multiple OAuth2 providers via the oauth2: true flag are affected. This vulnerability is fixed in 9.6.0-alpha.11 and 8.6.37.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.2V10.4.5V15.1.3V15.4.1
Mitigating Controls (NIST 800-53 r5) AI
Maintaining separate execution domains for each process structurally eliminates unintended concurrent access to the same shared resources.
Preventing unintended information transfer through shared system resources directly addresses the improper concurrent modification that defines a race condition.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper synchronization primitives and concurrency testing that prevent race conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions, but does not prevent them at design or coding time.
Secure SDLC mandates concurrency controls and synchronization primitives that directly prevent race conditions.
Application security requirements can specify thread-safety and locking rules, but do not prescribe implementation details.
Secure architecture principles require proper synchronization and resource isolation, addressing the root cause of CWE-362.
Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.