Zaloguj się
Deutsch English Español Polski
Niska

parse-server auth adapter app ID validation can be circumvented

  • Ujawniono: 21.09.2022
  • Aktualizacja: 11.10.2026 10:22

Impact

Validation of the authentication adapter app ID for Facebook and Spotify may be circumvented.

This fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for Facebook or Spotify and where the server-side authentication adapter configuration appIds is set as a string (e.g. abc) instead of an array of strings (e.g. ["abc"]). The vulnerability makes it possible to authenticate requests which are coming from a Facebook or Spotify app with a different app ID than the one specified in the appIds configuration.

Both adapters still validate the access token with the respective authentication provider. An app ID is automatically assigned by the authentication provider. For this vulnerability to be exploited, an attacker would have to be assigned an app ID by the authentication provider which is a sub-set of the server-side configured app ID.

The documentation did not explicitly specify that the parameter appIds must be set as an array of strings and setting a string also worked. Therefore, there is a possibility that there are deployments where appIds is set as a string, making them vulnerable.

Patches

The fix makes Parse Server check the type of the value set for appIds and throws an error if the value is not an array.

Workarounds

No known workarounds.

References

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka npm parse-server < 4.10.16, >= 5.0.0, < 5.2.7 4.10.16, 5.2.7

Odnośniki

Ocena CVSS 3.7/10
Wektor CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Słabość (CWE)
CWE-287
Platforma
npm
Paczka
parse-server
Ujawniono
21.09.2022
Aktualizacja
11.10.2026 10:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-r657-33vp-gp22 - CC BY 4.0

Historia podatności: parse-server

Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (116) w archiwum
Wszystkich wpisów
116
Pierwsza → ostatnia
06.2019 06.2026
Bez poprawki
0
Wykorzystywana w atakach
0

Rozkład istotności

  • Krytyczna 17
  • Wysoka 49
  • Średnia 40
  • Niska 10

Ujawnienia w latach

Istotność:
  1. parse-server: Denial of service via exponential-time processing of deeply nested query operators
    Wysoka CVE-2026-57480 >= 9.0.0, < 9.9.1-alpha.12, < 8.6.82 9.9.1-alpha.12, 8.6.82
  2. Parse Server: Pre-authentication denial of service via client version header regex backtracking
    Wysoka CVE-2026-47138 >= 9.0.0, < 9.9.1-alpha.1, < 8.6.77 9.9.1-alpha.1, 8.6.77
  3. Parser Server's streaming file download bypasses afterFind file trigger authorization
    Wysoka CVE-2026-34784 >= 9.0.0, < 9.7.1-alpha.1, < 8.6.71 9.7.1-alpha.1, 8.6.71
  4. parse-server has GraphQL complexity validator exponential fragment traversal DoS
    Wysoka CVE-2026-34573 >= 9.0.0, < 9.7.0-alpha.12, < 8.6.68 9.7.0-alpha.12, 8.6.68
  5. parse-server has cloud function validator bypass via prototype chain traversal
    Krytyczna CVE-2026-34532 >= 9.0.0, < 9.7.0-alpha.11, < 8.6.67 9.7.0-alpha.11, 8.6.67
  6. LiveQuery protected field leak via shared mutable state across concurrent subscribers
    Wysoka CVE-2026-34363 >= 9.0.0, < 9.7.0-alpha.9, < 8.6.65 9.7.0-alpha.9, 8.6.65
  7. Parse Server exposes auth data via verify password endpoint
    Wysoka CVE-2026-34215 >= 9.0.0, < 9.7.0-alpha.7, < 8.6.63 9.7.0-alpha.7, 8.6.63
  8. Parse Server exposes auth data via /users/me endpoint
    Wysoka CVE-2026-33627 >= 9.0.0, < 9.6.0-alpha.55, < 8.6.61 9.6.0-alpha.55, 8.6.61
  9. Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
    Wysoka CVE-2026-33539 >= 9.0.0, < 9.6.0-alpha.53, < 8.6.59 9.6.0-alpha.53, 8.6.59
  10. Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
    Wysoka CVE-2026-33538 >= 9.0.0, < 9.6.0-alpha.52, < 8.6.58 9.6.0-alpha.52, 8.6.58
  11. Parse Server LiveQuery subscription query depth bypass
    Wysoka · 7.5 CVE-2026-33508 >= 9.0.0, < 9.6.0-alpha.45, < 8.6.56 9.6.0-alpha.45, 8.6.56
  12. Parse Server has a query condition depth bypass via pre-validation transform pipeline
    Wysoka · 7.5 CVE-2026-33498 >= 9.0.0, < 9.6.0-alpha.44, < 8.6.55 9.6.0-alpha.44, 8.6.55
  13. Parse Server's LiveQuery bypasses CLP pointer permission enforcement
    Wysoka · 6.5 CVE-2026-33421 >= 9.0.0, < 9.6.0-alpha.42, < 8.6.53 9.6.0-alpha.42, 8.6.53
  14. Parse Server has an auth provider validation bypass on login via partial authData
    Wysoka · 9.1 CVE-2026-33409 >= 9.0.0, < 9.6.0-alpha.41, < 8.6.52 9.6.0-alpha.41, 8.6.52
  15. Parse Server leaks protected fields via LiveQuery afterEvent trigger
    Wysoka CVE-2026-33163 >= 9.0.0, < 9.6.0-alpha.35, < 8.6.50 9.6.0-alpha.35, 8.6.50
  16. Parse Server's Cloud function dispatch crashes server via prototype chain traversal
    Wysoka CVE-2026-32886 >= 9.0.0, < 9.6.0-alpha.24, < 8.6.47 9.6.0-alpha.24, 8.6.47
  17. Parse Server crash via deeply nested query condition operators
    Wysoka CVE-2026-32944 >= 9.0.0, < 9.6.0-alpha.21, < 8.6.45 9.6.0-alpha.21, 8.6.45
  18. Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
    Wysoka CVE-2026-32728 >= 9.0.0, < 9.6.0-alpha.15, < 8.6.41 9.6.0-alpha.15, 8.6.41
  19. Parse Server: Account takeover via operator injection in authentication data identifier
    Krytyczna CVE-2026-32248 >= 9.0.0, < 9.6.0-alpha.12, < 8.6.38 9.6.0-alpha.12, 8.6.38
  20. Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
    Krytyczna CVE-2026-32242 >= 9.0.0, < 9.6.0-alpha.11, < 8.6.37 9.6.0-alpha.11, 8.6.37
  21. Parse Server's MFA recovery codes not consumed after use
    Wysoka CVE-2026-31875 >= 9.0.0-alpha.1, < 9.6.0-alpha.7, < 8.6.33 9.6.0-alpha.7, 8.6.33
  22. Parse Server has a protected fields bypass via dot-notation in query and sort
    Wysoka CVE-2026-31872 >= 9.0.0-alpha.1, < 9.6.0-alpha.6, < 8.6.32 9.6.0-alpha.6, 8.6.32
  23. Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
    Krytyczna CVE-2026-31871 >= 9.0.0-alpha.1, < 9.6.0-alpha.5, < 8.6.31 9.6.0-alpha.5, 8.6.31
  24. Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
    Krytyczna CVE-2026-31856 >= 9.0.0-alpha.1, < 9.6.0-alpha.3, < 8.6.29 9.6.0-alpha.3, 8.6.29
  25. Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
    Wysoka CVE-2026-31800 >= 9.0.0-alpha.1, < 9.5.2-alpha.12, < 8.6.25 9.5.2-alpha.12, 8.6.25
  26. Parse Server OAuth2 authentication adapter account takeover via identity spoofing
    Wysoka CVE-2026-30967 >= 9.0.0-alpha.1, < 9.5.2-alpha.9, < 8.6.22 9.5.2-alpha.9, 8.6.22
  27. Parse Server has role escalation and CLP bypass via direct `_Join` table write
    Krytyczna · 10.0 CVE-2026-30966 >= 9.0.0-alpha.1, < 9.5.2-alpha.7, < 8.6.20 9.5.2-alpha.7, 8.6.20
  28. Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter
    Krytyczna CVE-2026-30965 >= 9.0.0-alpha.1, < 9.5.2-alpha.8, < 8.6.21 9.5.2-alpha.8, 8.6.21
  29. Parse Server has a protected fields bypass via logical query operators
    Wysoka CVE-2026-30962 >= 9.0.0, < 9.5.2-alpha.6, < 8.6.19 9.5.2-alpha.6, 8.6.19
  30. Parse Server missing audience validation in Keycloak authentication adapter
    Wysoka CVE-2026-30949 >= 9.0.0, < 9.5.2-alpha.5, < 8.6.18 9.5.2-alpha.5, 8.6.18
  31. Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload
    Wysoka CVE-2026-30948 >= 9.0.0, < 9.5.2-alpha.4, < 8.6.17 9.5.2-alpha.4, 8.6.17
  32. Parse Server has a bypass of class-level permissions in LiveQuery
    Wysoka CVE-2026-30947 >= 9.0.0, < 9.5.2-alpha.3, < 8.6.16 9.5.2-alpha.3, 8.6.16
  33. Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
    Wysoka CVE-2026-30946 < 8.6.15, >= 9.0.0, < 9.5.2-alpha.2 8.6.15, 9.5.2-alpha.2
  34. Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
    Wysoka CVE-2026-30941 >= 9.0.0, < 9.5.2-alpha.1, < 8.6.14 9.5.2-alpha.1, 8.6.14
  35. Parse Server: SQL injection via dot-notation field name in PostgreSQL
    Krytyczna CVE-2026-31840 >= 9.0.0, < 9.6.0-alpha.2, < 8.6.28 9.6.0-alpha.2, 8.6.28
  36. Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
    Wysoka CVE-2026-30939 < 8.6.13, >= 9.0.0-alpha.1, < 9.5.1-alpha.2 8.6.13, 9.5.1-alpha.2
  37. Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
    Wysoka CVE-2026-30925 >= 9.0.0-alpha.1, < 9.5.0-alpha.14, < 8.6.11 9.5.0-alpha.14, 8.6.11
  38. Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
    Krytyczna CVE-2026-30863 >= 9.0.0-alpha.1, < 9.5.0-alpha.11, < 8.6.10 9.5.0-alpha.11, 8.6.10
  39. parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
    Wysoka CVE-2026-30229 < 8.6.6, >= 9.0.0, < 9.5.0-alpha.4 8.6.6, 9.5.0-alpha.4
  40. Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
    Wysoka CVE-2026-29182 >= 9.0.0, < 9.4.1-alpha.3, < 8.6.4 9.4.1-alpha.3, 8.6.4
  41. Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
    Krytyczna CVE-2026-27804 >= 9.0.0, < 9.3.1-alpha.4, < 8.6.3 9.3.1-alpha.4, 8.6.3
  42. Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
    Wysoka CVE-2025-68150 >= 9.0.0, < 9.1.1-alpha.1, < 8.6.2 9.1.1-alpha.1, 8.6.2
  43. Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
    Wysoka · 7.5 CVE-2025-64430 >= 4.2.0, < 7.5.4, >= 8.0.0, < 8.4.0-alpha.2 7.5.4, 8.4.0-alpha.2
  44. Parse Server's custom object ID allows to acquire role privileges
    Wysoka · 8.1 CVE-2024-47183 < 6.5.9, >= 7.0.0, < 7.3.0 6.5.9, 7.3.0
  45. ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
    Krytyczna · 9.8 CVE-2024-39309 < 6.5.7, >= 7.0.0, < 7.1.0 6.5.7, 7.1.0
  46. Server crashes on invalid Cloud Function or Cloud Job name
    Krytyczna · 9.0 CVE-2024-29027 < 6.5.5, >= 7.0.0-alpha.1, < 7.0.0-alpha.29 6.5.5, 7.0.0-alpha.29
  47. ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
    Krytyczna · 10.0 CVE-2024-27298 < 6.5.0, >= 7.0.0-alpha.1, < 7.0.0-alpha.20 6.5.0, 7.0.0-alpha.20
  48. Parse Server may crash when uploading file without extension
    Wysoka · 7.5 CVE-2023-46119 >= 1.0.0, < 5.5.6, >= 6.0.0, < 6.3.1 5.5.6, 6.3.1
  49. Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer
    Wysoka · 7.5 CVE-2023-41058 >= 1.0.0, < 5.5.5, >= 6.0.0, < 6.2.2 5.5.5, 6.2.2
  50. Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
    Krytyczna · 9.8 CVE-2023-36475 < 5.5.2, >= 6.0.0, < 6.2.1 5.5.2, 6.2.1
  51. Parse Server option `masterKeyIps` vulnerability to IP spoofing
    Wysoka · 8.7 CVE-2023-22474 < 5.4.1 5.4.1
  52. Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks
    Wysoka · 7.2 CVE-2022-41879 < 4.10.20, >= 5.0.0, < 5.3.3 4.10.20, 5.3.3
  53. Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers
    Wysoka · 7.2 CVE-2022-41878 < 4.10.19, >= 5.0.0, < 5.3.2 4.10.19, 5.3.2
  54. Remote code execution via MongoDB BSON parser through prototype pollution
    Krytyczna · 9.8 CVE-2022-39396 < 4.10.18, >= 5.0.0, < 5.3.1 4.10.18, 5.3.1
  55. parse-server crashes when receiving file download request with invalid byte range
    Wysoka · 7.5 CVE-2022-39313 < 4.10.17, >= 5.0.0, < 5.2.8 4.10.17, 5.2.8
  56. parse-server auth adapter app ID validation can be circumvented ten wpis
    Niska · 3.7 CVE-2022-39231 < 4.10.16, >= 5.0.0, < 5.2.7 4.10.16, 5.2.7
  57. Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
    Wysoka · 8.6 CVE-2022-36079 < 4.10.14, >= 5.0.0, < 5.2.5 4.10.14, 5.2.5
  58. Protected fields exposed via LiveQuery
    Wysoka · 8.2 CVE-2022-31112 < 4.10.13, >= 5.0.0, < 5.2.4 4.10.13, 5.2.4
  59. Invalid file request can crash server
    Wysoka · 7.5 CVE-2022-31089 < 4.10.12, >= 5.0.0, < 5.2.3 4.10.12, 5.2.3
  60. Authentication bypass vulnerability in Apple Game Center auth adapter
    Wysoka · 8.6 CVE-2022-31083 < 4.10.11, >= 5.0.0, < 5.2.2 4.10.11, 5.2.2
Pokaż więcej (7) Widać 60 z 67

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.