CVE-2025-30168: Parse Server Auth Bypass Vulnerability

CVE-2025-30168 Overview

Parse Server is an open source backend deployable to any Node.js infrastructure. CVE-2025-30168 affects the third-party authentication handling in Parse Server versions prior to 7.5.2 and 8.0.2. The flaw allows authentication credentials from certain providers to be reused across unrelated Parse Server applications. If a user signs up using the same provider in two independent apps, credentials stored by one app can authenticate that user in the other. The vulnerability is tracked under [CWE-287] Improper Authentication and is fixed in Parse Server 7.5.2 and 8.0.2.

Critical Impact
Attackers who control one Parse Server app can reuse stored third-party authentication payloads to impersonate the same user in unrelated Parse Server deployments.

Affected Products

Parse Server versions prior to 7.5.2
Parse Server 8.x versions prior to 8.0.2
Parse Server applications configured with the auth option using an affected third-party authentication adapter

Discovery Timeline

2025-03-21 - CVE-2025-30168 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30168

Vulnerability Analysis

Parse Server exposes third-party authentication through configurable adapters set via the auth option. Prior to the fix, the adapter interface did not require adapter-specific validation against a bound client identifier or secret. Client-supplied authData payloads accepted by one Parse Server instance were structured such that the same payload could be replayed against a different Parse Server instance using the same provider. This crosses the trust boundary between independent Parse Server tenants that share a common upstream identity provider.

The patch introduces a BaseCodeAuthAdapter abstract class that mandates clientId and clientSecret configuration for each deployment, unless the operator explicitly opts into legacy behavior via enableInsecureAuth. This binds validated authentications to a specific application registration rather than the shared provider identity.

Root Cause

The root cause is [CWE-287] Improper Authentication in the auth adapter contract defined in src/Adapters/Auth/AuthAdapter.js. Adapters validated authData without verifying it was issued for the receiving Parse Server app. The insecure payload format lacked an app-bound proof, so credentials scoped to one Parse Server app remained valid for another.

Attack Vector

An attacker who operates or compromises one Parse Server application can capture the authData payload a user submits during signup or login through an affected provider. The attacker then replays that payload against a second, unrelated Parse Server application where the same user has an account with the same provider. The second app accepts the credentials and issues a session for the target user. Exploitation requires user interaction and matching provider usage across both apps, which is reflected in the high attack complexity.

javascript

// Patch: src/Adapters/Auth/BaseCodeAuthAdapter.js
// Enforces per-app clientId/clientSecret unless insecure mode is opted in.
import AuthAdapter from './AuthAdapter';
export default class BaseAuthCodeAdapter extends AuthAdapter {
  constructor(adapterName) {
    super();
    this.adapterName = adapterName;
  }
  validateOptions(options) {
    if (!options) {
      throw new Error(`${this.adapterName} options are required.`);
    }
    this.enableInsecureAuth = options.enableInsecureAuth;
    if (this.enableInsecureAuth) {
      return;
    }
    this.clientId = options.clientId;
    this.clientSecret = options.clientSecret;
    if (!this.clientId) {
      throw new Error(`${this.adapterName} clientId is required.`);
    }
    if (!this.clientSecret) {
      throw new Error(`${this.adapterName} clientSecret is required.`);
    }
  }
}
// Source: https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e

The patch also reorders the validateAuthData, validateSetUp, and related adapter method signatures to pass options before request, aligning legacy adapters with the new secure validation contract.

Detection Methods for CVE-2025-30168

Indicators of Compromise

Successful /parse/users or /parse/login requests where the authData payload originated from a different Parse Server tenant or client build
Session tokens issued for users whose provider id matches a known account but whose source IP, device, or User-Agent deviates from historical patterns
Parse Server logs showing repeated authentication attempts using identical third-party provider id values across unrelated app IDs

Detection Strategies

Audit Parse Server configuration for the auth option and enumerate which third-party adapters are enabled without clientId and clientSecret bound to the specific app registration
Correlate authentication events by provider id across all Parse Server deployments in the environment to detect the same identity authenticating with mismatched application context
Alert on Parse Server versions below 7.5.2 or below 8.0.2 discovered through software inventory or container image scanning

Monitoring Recommendations

Forward Parse Server authentication logs to a centralized log platform and retain full authData metadata for post-incident review
Monitor for unexpected use of the enableInsecureAuth option in adapter configurations after upgrade
Track provider-side sign-in telemetry (Facebook, Google, Apple, etc.) and reconcile against Parse Server session issuance for anomalies

How to Mitigate CVE-2025-30168

Immediate Actions Required

Upgrade Parse Server to version 7.5.2 or 8.0.2 or later
Update client applications to send the new secure authData payload format required by the fixed server
Configure each affected auth adapter with a unique clientId and clientSecret scoped to the specific Parse Server application
Invalidate active session tokens issued through affected third-party providers and force re-authentication

Patch Information

The fix is delivered in Parse Server 7.5.2 and 8.0.2. Server-side changes are documented in GitHub Pull Request #9667 and GitHub Pull Request #9668, with the primary code changes in GitHub Commit 2ff9c71 and GitHub Commit 5ef0440. Full remediation guidance is available in the GitHub Security Advisory GHSA-837q-jhwx-cmpv. Both the server and the client SDK must be upgraded together, as the secure payload format is not backward compatible with the previous insecure structure.

Workarounds

If upgrade cannot be performed immediately, disable affected third-party authentication adapters in the Parse Server auth configuration until both server and client can be updated
Do not enable the enableInsecureAuth option after upgrading, as this preserves the vulnerable legacy behavior
Restrict Parse Server exposure to trusted networks and require additional authentication factors where possible until patches are applied

bash

# Upgrade Parse Server via npm
npm install parse-server@8.0.2 --save

# Or for the 7.x branch
npm install parse-server@7.5.2 --save

# Verify installed version
npm ls parse-server