9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27804

CVE-2026-27804: Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with alg: "none" to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected RS256 algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with jwks-rsa which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27804

CVE-2026-27804:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, <= 9.3.1-alpha.3	9.3.1-alpha.4
parse-server	npm	<= 8.6.2	8.6.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the JWT (JSON Web Token) verification process within the Google, Apple, and Facebook authentication adapters of Parse Server. The core issue, known as algorithm confusion, is in the verifyIdToken function in each of these adapters. The vulnerable code extracted the signing algorithm directly from the alg field of the JWT header and used it for verification. An attacker could craft a JWT with the alg header set to "none", which would cause the jsonwebtoken library to skip the signature verification step entirely. This would allow an unauthenticated attacker to forge a token for any user and gain unauthorized access to their account.

The patch addresses this by removing the code that reads the algorithm from the token header. Instead, it hardcodes the expected signing algorithm to ['RS256'] during the jwt.verify call. This ensures that only tokens signed with the correct and expected algorithm are accepted. Additionally, the key fetching mechanism in the Google adapter was replaced with the more secure jwks-rsa library to better handle JSON Web Key Sets (JWKS) and reject tokens with unknown key IDs (kid).

Vulnerable functions

verifyIdToken

src/Adapters/Auth/google.js

The function `verifyIdToken` in the Google authentication adapter was vulnerable to JWT algorithm confusion. It extracted the signing algorithm from the JWT header (`alg`) and used it to verify the token. An attacker could provide a token with `"alg":"none"`, bypassing signature verification and allowing them to impersonate any user.

getGoogleKeyByKeyId

src/Adapters/Auth/google.js

This function was responsible for fetching the Google signing keys. The original implementation was replaced with the `jwks-rsa` library to provide more robust key handling and prevent the use of keys with unknown IDs, which was part of the overall vulnerability.

verifyIdToken

src/Adapters/Auth/apple.js

Similar to the Google adapter, the `verifyIdToken` function in the Apple authentication adapter was also vulnerable to JWT algorithm confusion. It used the algorithm from the token header for verification, which was fixed by hardcoding the algorithm to `RS256`.

verifyIdToken

src/Adapters/Auth/facebook.js

Similar to the Google adapter, the `verifyIdToken` function in the Facebook authentication adapter was also vulnerable to JWT algorithm confusion. It used the algorithm from the token header for verification, which was fixed by hardcoding the algorithm to `RS256`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.