Algorithm Confusion: Critical 9.1 Flaw in Parse Server Allows Instant Google Account Takeover
Do Son 
Parse Server, a widely used open-source backend designed to be deployed on any infrastructure running Node.js and working alongside the Express web application framework, is currently affected by a highly critical security flaw. Tracked as CVE-2026-27804, this vulnerability boasts a severe CVSSv4 score of 9.1.
The root of the issue is an “algorithm confusion” vulnerability located within the platform’s Google authentication adapter. By manipulating a JSON Web Token (JWT) to specify alg: “none” in its header, an unauthenticated attacker can successfully forge a Google authentication token.
This exploit is particularly dangerous because it grants the attacker the ability to log in as any user whose account is linked to Google, completely bypassing the need for the user’s actual credentials. Consequently, all Parse Server deployments that currently have Google authentication enabled are vulnerable to this account takeover threat.
Administrators must verify their current deployment versions immediately to determine their exposure.
- Affected Versions: The vulnerability impacts versions >= 9.0.0 <= 9.3.1-alpha.3 as well as versions <= 8.6.2.
- Patched Versions: Safe, upgraded versions are 9.3.1-alpha.4 and 8.6.3.
The recently released patches successfully neutralize this threat by fundamentally changing how the token is validated. The fix hardcodes the expected RS256 algorithm rather than blindly trusting the algorithm provided in the JWT header. Furthermore, the update replaces the Google adapter’s custom key fetcher with the jwks-rsa library, which automatically rejects any unknown key IDs.
If your organization is unable to apply these patches immediately, there is a straightforward workaround: you must disable Google authentication entirely until a secure upgrade can be performed.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
