Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

The core of this vulnerability lies in the misconfiguration of the authentication adapters. Specifically, if the clientId (for Google/Apple) or appIds (for Facebook) audience configuration option is not set, the JWT verification process silently skips audience claim validation. This means an attacker can craft a validly signed JWT intended for a different application and successfully use it to authenticate as any user on the vulnerable Parse Server instance. The potential impact is severe, ranging from unauthorized data access and modification to complete account compromise and potential lateral movement within the application ecosystem. This bypass effectively renders the authentication mechanism useless, allowing attackers to impersonate legitimate users without proper credentials.

Organizations utilizing Parse Server for backend services, particularly those relying on Google, Apple, or Facebook authentication, are at risk. Deployments with misconfigured authentication adapters, especially those in production environments, are particularly vulnerable. Shared hosting environments where Parse Server instances may be configured by multiple users also face increased risk.

• nodejs / server:

# Check Parse Server configuration files for missing clientId/appIds
grep -r 'clientId' /path/to/parse-server/config.yml
grep -r 'appIds' /path/to/parse-server/config.yml

• generic web:

# Monitor access logs for JWT requests with unusual origins or missing audience claims
curl -I <parse-server-url>/parse/login | grep 'Audience:'

1. 2026-03-09Disclosure

   disclosure

1. Réservé2026-03-05
2. Publiée2026-03-09
3. Modifiée2026-03-16
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-30863 is to immediately upgrade Parse Server to version 9.5.0-alpha.11 or later. Prior to upgrading, carefully review your authentication adapter configurations to ensure the clientId (Google/Apple) and appIds (Facebook) options are correctly set. If an upgrade is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing JWTs with missing or invalid audience claims. While not a complete solution, this can provide a temporary layer of defense. Monitor Parse Server logs for unusual authentication activity, particularly attempts to authenticate with JWTs from unexpected sources. There are no specific Sigma or YARA rules available at this time, but monitoring JWT payload structure for unexpected claims is recommended.