9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30863

CVE-2026-30863: Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration option is not set (clientId for Google/Apple, appIds for Facebook), JWT verification silently skips audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server. This issue has been patched in versions 8.6.10 and 9.5.0-alpha.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30863

CVE-2026-30863:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0-alpha.1, < 9.5.0-alpha.11	9.5.0-alpha.11
parse-server	npm	< 8.6.10	8.6.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists across the Google, Apple, and Facebook authentication adapters in Parse Server. The root cause is the improper validation of the JSON Web Token (JWT) 'audience' (aud) claim. In all three adapters, the verifyIdToken function was responsible for validating the identity token provided by the authentication provider.

For the Google and Apple adapters, the code did not enforce the presence of the clientId in the server configuration. When this value was missing, the check for the JWT's audience was silently skipped. This allowed an attacker with a valid JWT from any application to authenticate as a user on the target Parse Server, as the server failed to verify that the token was intended for its specific application clientId.

For the Facebook adapter's 'Limited Login' flow, the issue was that the code was written to check for clientId but the correct configuration for this flow is appIds. The code never passed the appIds to the JWT verification library. This resulted in the audience check always being skipped, regardless of the server's configuration.

The patches address these issues by adding strict checks to ensure that clientId (for Google/Apple) and appIds (for Facebook) are present in the configuration. If they are missing, the authentication process now fails with an error. Furthermore, the Facebook adapter was corrected to use appIds for audience validation, ensuring that the JWT is validated against the correct application identifier(s).

Vulnerable functions

verifyIdToken

src/Adapters/Auth/google.js

The function `verifyIdToken` in the Google authentication adapter was vulnerable because it did not enforce the presence of the `clientId` in the configuration. If the `clientId` was not provided, the function would proceed without validating the JWT's 'audience' (aud) claim. This allowed an attacker to use a valid JWT issued for a different application (a different `clientId`) to successfully authenticate against the Parse Server instance.

verifyIdToken

src/Adapters/Auth/apple.js

The function `verifyIdToken` in the Apple authentication adapter was vulnerable because it did not enforce the presence of the `clientId` in the configuration. If the `clientId` was not provided, the function would proceed without validating the JWT's 'audience' (aud) claim. This allowed an attacker to use a valid JWT issued for a different application (a different `clientId`) to successfully authenticate against the Parse Server instance.

verifyIdToken

src/Adapters/Auth/facebook.js

The function `verifyIdToken` in the Facebook authentication adapter was vulnerable in two ways for the 'Limited Login' flow. First, it failed to enforce the presence of the `appIds` configuration. Second, it was incorrectly trying to use `clientId` for audience validation instead of `appIds`. This meant that audience validation was never correctly performed, allowing an attacker to use a valid JWT from any Facebook application to authenticate.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.