An authentication bypass vulnerability in Parse Server allows attackers with a valid OAuth2 token to impersonate any user on the system, posing a critical risk to data confidentiality and integrity.

This is an improper authentication flaw (CWE-287) where the OAuth2 adapter fails to verify that a token belongs to the user identified by the authData parameter. By providing any valid token from the configured OAuth2 provider, an attacker can authenticate as any other user within the application.

Successful exploitation grants an attacker full access to the account of any user, including administrative accounts if targeted. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to widespread unauthorized data access, modification of user records, and complete compromise of the backend application environment.

Immediate Action: Update Parse Server to version 9.5.2-alpha.9 or 8.6.22 immediately to resolve the authentication logic flaw.

Proactive Monitoring: Review application access logs for suspicious authentication patterns or multiple successful logins originating from unusual user-token pairings.

Compensating Controls: If immediate patching is not feasible, ensure the useridField option is explicitly configured for all OAuth2 authentication adapters to enforce strict identity verification.

Public Exploit Available: No (exploit_available unknown).

Organizations utilizing Parse Server with OAuth2 authentication must prioritize this update, as the vulnerability directly undermines the integrity of the user authentication process. Administrators should verify their current configuration and apply the recommended patch versions immediately to prevent potential account takeover attacks.