CVE-2026-101042: Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity
Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo) verify the client's authorization code with the external provider on signup and on provider linking, but not when authentication data is supplied together with a username and password on the login endpoint. As a result, a low-privileged authenticated user can attach an arbitrary, unverified provider identity to their own account without the provider ever being contacted, spoofing an external identity toward application logic that trusts the linked provider ID. An attacker can also pre-hijack accounts: by claiming the provider ID of a victim who has not yet linked that provider, the victim's later legitimate sign-in with that provider resolves to the attacker's account. Only deployments configuring one of the affected code-based auth adapters are impacted. Versions 9.10.1-alpha.10 and 8.6.91 fix the issue by running the adapter's credential verification on the login and challenge endpoints and rejecting a provider identity already linked to another user. As a workaround, disable the affected code-based auth adapters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 9.10.1-alpha.10 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 8.6.91 - Configuration
Disable the affected code-based authentication adapters: GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, and Weibo.
Parse Server code-based authentication adapters enabled = false
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments that configure at least one affected code-based authentication adapter are impacted. The affected adapters are GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, and Weibo.
What does an attacker need to exploit this issue?
The attacker needs a low-privileged authenticated account and access to the login endpoint using a username and password. They can then attach an arbitrary provider identity to their own account without the external provider being contacted.
What is the practical impact for applications that trust provider identities?
An attacker can spoof a linked external provider ID toward application logic that treats that ID as trusted. They can also claim a victim's provider ID before the victim links it, causing the victim's later provider sign-in to resolve to the attacker's account.
Which versions contain the fix?
The issue is fixed in versions 9.10.1-alpha.10 and 8.6.91. The fixes verify adapter credentials on the login and challenge endpoints and reject provider identities already linked to another account.