CVE-2026-101042: Parse Server Auth Bypass Vulnerability

CVE-2026-101042 Overview

CVE-2026-101042 is an authentication bypass vulnerability in Parse Server, an open-source backend server. The flaw affects code-based authentication adapters including GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, and Weibo. These adapters verify authorization codes with the external provider on signup and account linking, but skip verification when authentication data is supplied alongside a username and password on the login endpoint. A low-privileged authenticated user can attach an arbitrary, unverified provider identity to their own account. The weakness is tracked as [CWE-287] Improper Authentication.

Critical Impact
Attackers can spoof external identities and pre-hijack accounts by claiming provider IDs of victims who have not yet linked their third-party accounts.

Affected Products

Parse Server versions >= 9.0.0 and < 9.10.1-alpha.10
Parse Server versions >= 8.0.2 and < 8.6.91
Deployments configured with one of the affected code-based authentication adapters

Discovery Timeline

2026-09-27 - CVE-2026-101042 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101042

Vulnerability Analysis

Parse Server exposes authentication adapters that complete an OAuth-style code exchange with external identity providers. On the signup and provider-linking endpoints, the adapter contacts the provider to validate the submitted authorization code. The login endpoint, however, accepts authentication data submitted together with a username and password without performing the same validation. The server trusts the attacker-supplied provider identity and attaches it to the authenticated account.

Two attack outcomes follow. First, an authenticated user can bind an arbitrary provider identity to their account, spoofing a third-party identity toward application logic that trusts the linked provider ID. Second, an attacker can pre-hijack accounts by claiming a victim's provider ID before the victim ever links that provider. When the victim later signs in legitimately through the provider, Parse Server resolves the session to the attacker's account.

Root Cause

The root cause is missing credential verification on the login and challenge endpoints. The adapter's verification routine executes only on signup and link flows. Parse Server also failed to reject a provider identity already linked to another user, enabling identity collision.

Attack Vector

Exploitation requires network access to the Parse Server API and a low-privileged authenticated session. The attacker submits a login request containing a username, password, and crafted authData payload referencing an arbitrary provider user ID. The server accepts the payload without contacting the provider and persists the link. See the GitHub Security Advisory and the Vulncheck Advisory on Parse Server for additional technical details.

Detection Methods for CVE-2026-101042

Indicators of Compromise

Login requests to Parse Server containing authData for GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, or Weibo alongside username and password credentials.
Accounts whose linked provider identities were added without a corresponding signup or explicit link request in application logs.
Multiple user accounts referencing the same external provider ID across the _User collection.

Detection Strategies

Audit the _User collection for duplicate or collision entries in authData fields, which indicate pre-hijack attempts.
Correlate authentication logs against provider-side login records to find linked identities with no matching provider callback.
Alert on login requests that submit authData payloads for adapters that your application does not normally use at login time.

Monitoring Recommendations

Enable verbose logging on Parse Server authentication adapters and forward logs to a centralized SIEM for review.
Monitor for unexpected changes to the authData property of existing user records.
Track rates of login requests carrying authData and investigate statistical anomalies.

How to Mitigate CVE-2026-101042

Immediate Actions Required

Upgrade Parse Server to version 9.10.1-alpha.10 or 8.6.91, which run adapter credential verification on login and challenge endpoints.
Review the _User collection for provider identities that may have been attached without verification and unlink suspect entries.
Force re-authentication for accounts holding linked identities from the affected adapters.

Patch Information

Parse Server versions 9.10.1-alpha.10 and 8.6.91 fix the issue by invoking the adapter's credential verification on the login and challenge endpoints. The patched releases also reject any provider identity already linked to another user, preventing identity collision and pre-hijack scenarios. Patch details are available in the GitHub Security Advisory GHSA-mr43-w6c2-mvjq.

Workarounds

Disable the affected code-based authentication adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo) until the patched version is deployed.
Restrict API exposure of the login endpoint to trusted networks where feasible while patching is scheduled.
Audit application authorization logic that trusts linked provider IDs and require secondary verification for sensitive actions.

bash

# Configuration example: remove affected adapters from Parse Server auth config
# Edit your Parse Server initialization to omit code-based adapters
# Example (Node.js):
#   auth: {
#     // github: { ... },      <- remove
#     // linkedin: { ... },    <- remove
#     // microsoft: { ... },   <- remove
#   }
npm install parse-server@8.6.91
# or
npm install parse-server@9.10.1-alpha.10