Algorithm Confusion: Critical 9.1 Flaw in Parse Server Allows Instant Google Account Takeover

Parse Server, a widely used open-source backend designed to be deployed on any infrastructure running Node.js and working alongside the Express web application framework, is currently affected by a highly critical security flaw. Tracked as CVE-2026-27804, this vulnerability boasts a severe CVSSv4 score of 9.1.

The root of the issue is an “algorithm confusion” vulnerability located within the platform’s Google authentication adapter. By manipulating a JSON Web Token (JWT) to specify alg: “none” in its header, an unauthenticated attacker can successfully forge a Google authentication token.

This exploit is particularly dangerous because it grants the attacker the ability to log in as any user whose account is linked to Google, completely bypassing the need for the user’s actual credentials. Consequently, all Parse Server deployments that currently have Google authentication enabled are vulnerable to this account takeover threat.

Administrators must verify their current deployment versions immediately to determine their exposure.

• Affected Versions: The vulnerability impacts versions >= 9.0.0 <= 9.3.1-alpha.3 as well as versions <= 8.6.2.
• Patched Versions: Safe, upgraded versions are 9.3.1-alpha.4 and 8.6.3.

The recently released patches successfully neutralize this threat by fundamentally changing how the token is validated. The fix hardcodes the expected RS256 algorithm rather than blindly trusting the algorithm provided in the JWT header. Furthermore, the update replaces the Google adapter’s custom key fetcher with the jwks-rsa library, which automatically rejects any unknown key IDs.

If your organization is unable to apply these patches immediately, there is a straightforward workaround: you must disable Google authentication entirely until a secure upgrade can be performed.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.