Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance

Description

Parse Server’s built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **< 8.6.37

  >= 9.0.0, < 9.6.0-alpha.11**

• Patched version(s): **8.6.37

  9.6.0-alpha.11**

References

• GHSA-2cjm-2gwv-m892
• CVE-2026-32242
• CWE-362
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Parse Server OAuth2 authentication adapter account takeover via identity spoofing - CVE-2026-30967
• Parse Server: Denial of Service via unindexed database query for unconfigured auth providers - CVE-2026-33538
• Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint - CVE-2026-32269
• Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter - CVE-2026-27804

Tags:

npm

parse-server