Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Description

The OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value is sent to the token introspection endpoint instead of the user’s actual access token.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 8.0.2, < 8.6.39

  >= 9.0.0, < 9.6.0-alpha.13**

• Patched version(s): **8.6.39

  9.6.0-alpha.13**

References

• GHSA-69xg-f649-w5g2
• CVE-2026-32269
• CWE-683
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Parse Server OAuth2 authentication adapter account takeover via identity spoofing - CVE-2026-30967
• Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance - CVE-2026-32242
• parse-server auth adapter app ID validation can be circumvented - CVE-2022-39231
• Parse Server missing audience validation in Keycloak authentication adapter - CVE-2026-30949

Tags:

npm

parse-server