Critical

JWT audience validation bypass in Parse Server social authentication adapters

IdentifiersCVE-2026-30863CWE-287· Improper Authentication

CVE-2026-30863 affects Parse Server prior to versions 8.6.10 and 9.5.0-alpha.11. The vulnerability is in the Google, Apple, and Facebook authentication adapters, which use JWT verification to validate identity tokens. When the adapter audience configuration is not set—clientId for Google and Apple, or appIds for Facebook—the JWT verification flow silently skips validation of the token's aud claim. As a result, a validly signed identity token issued by the provider for a different application can be accepted by the target Parse Server instance. This breaks the trust boundary between applications and can allow an attacker to authenticate as arbitrary users on the vulnerable Parse Server deployment.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows improper authentication against the target Parse Server. An attacker can present a validly signed JWT issued for another application and, if audience validation is skipped due to missing adapter configuration, authenticate as any user represented by that token on the target instance. This can lead to unauthorized access to application data and actions with high confidentiality and integrity impact. No user interaction or prior authentication is required beyond obtaining a valid provider-signed token for a different application.

Mitigation

If you can’t patch tonight, do this now.

On vulnerable versions, ensure the audience-related configuration is explicitly set for affected adapters: clientId for Google and Apple. This reduces exposure by causing JWT audience claims to be validated. For Facebook Limited Login, the provided content states there is no effective workaround on vulnerable versions; the practical mitigation is to upgrade to a fixed release. More generally, disable affected social login adapters if they are not required until patching is completed.

Remediation

Patch, then assume compromise.

Upgrade Parse Server to a fixed version: 8.6.10 or later in the 8.x branch, or 9.5.0-alpha.11 or later in the 9.x branch. According to the advisory, the fix makes clientId mandatory for Google and Apple adapters and appIds mandatory for Facebook, and ensures those values are passed into JWT audience validation so the aud claim is enforced.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Parse PlatformParse Serverapplication

parse-communityParse Serverapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

cvefeed high severityNews

Mar 7, 2026

CVE-2026-30863 - Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

Authentication bypass / improper authentication in Parse Server social login adapters due to missing JWT audience claim validation when audience configuration is unset, enabling token replay from another application to impersonate users.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity8