Authentication Bypass in Parse Server by Open-Source Vendor

CVE-2026-101042

What is CVE-2026-101042?

The Parse Server is susceptible to an authentication bypass vulnerability resulting from inadequate verification of client authorization codes when using certain code-based authentication adapters. Versions of Parse Server from 9.0.0 up to but not including 9.10.1-alpha.10 and 8.0.2 up to but not including 8.6.91 allow low-privileged users to link arbitrary external identities to their accounts without valid verification from the external provider. This could lead to account hijacking, where an attacker preempts the legitimate provider ID of another user before they link it. The issue has been resolved in later versions, which now enforce credential verification during logins and challenges, thus preventing the linking of provider identities already associated with other accounts.

References