A race condition vulnerability in Parse Server's OAuth2 authentication adapter allows for potential authentication bypass when multiple providers are configured, posing a high risk to identity integrity.

The vulnerability is a race condition (CWE-362) where the OAuth2 adapter uses a shared singleton instance. This allows an unauthenticated attacker to exploit concurrent requests, causing a token meant for one provider to be validated against the policy of another, potentially resulting in unauthorized authentication.

The exploitation of this flaw could allow unauthorized users to gain access to protected systems by bypassing intended identity provider restrictions. With a CVSS score of 7.4, this represents a high-severity risk, as it directly undermines the authentication security of the backend infrastructure and could lead to unauthorized data access or administrative control.

Immediate Action: Update Parse Server to version 9.6.0-alpha.11 or 8.6.37 immediately to resolve the shared resource synchronization error.

Proactive Monitoring: Review application access logs for unusual patterns involving rapid, concurrent authentication requests that might indicate an attempt to induce a race condition.

Compensating Controls: If patching is delayed, limit the deployment to a single OAuth2 provider if business requirements allow, as the vulnerability specifically affects configurations utilizing multiple providers.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for unauthorized access through authentication bypass, this vulnerability should be prioritized for remediation. Organizations utilizing Parse Server with multiple OAuth2 providers must upgrade to the specified fixed versions as soon as possible to ensure that identity validation logic remains isolated and secure.