CVE-2026-27804

Katalog CVE

CVSS 9.1 · Critical EPSS 0,23%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada parseplatform parse-server. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with `alg: "none"` to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected `RS256` algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with `jwks-rsa` which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.

Rincian

Terbit di NVD

26 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2 patch · advisory vendor
• https://github.com/parse-community/parse-server/commit/9b94083accb7f3e72c6b8126c195c7a03dd2dfd7 patch
• https://github.com/parse-community/parse-server/commit/9d5942d50e55c822924c27b05aa98f1393e7a330 patch
• https://github.com/parse-community/parse-server/releases/tag/8.6.3 release notes
• https://github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4 release notes