CVE-2026-32242

The built-in OAuth2 adapter in Parse Server exports a single instance (singleton) that is shared by all OAuth2 provider configurations. When authentication requests for different OAuth2 providers arrive at the server simultaneously, a situation may occur where token validation for one provider is performed using the configuration (policy) of another provider. As a result, a token that should be rejected by the correct provider may be incorrectly accepted — because it is verified against another provider's policy. The vulnerability affects only deployments using multiple OAuth2 providers configured with the oauth2: true flag.

An attacker can gain unauthorized access to a user account or resources protected by Parse Server using an OAuth2 token that would normally be rejected. This results in a breach of data confidentiality and integrity.

Parse Server should be updated to version 8.6.37 (stable branch) or 9.6.0-alpha.11 (alpha branch). Patches are available in the vendor references on GitHub. If immediate updates are not possible, consider limiting the number of concurrent authentication requests or temporarily disabling support for multiple OAuth2 providers.

Parse Server (Parseplatform parse-server) in versions prior to 8.6.37 and prior to 9.6.0-alpha.11, with the vulnerability being active only in a configuration with multiple OAuth2 providers (oauth2: true flag).