VDB
KO
CRITICAL 9.1

GHSA-pfj7-wv7c-22pr

Parse Server has an auth provider validation bypass on login via partial authData

Details

### Impact

An authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token.

This affects Parse Server deployments where the server option `allowExpiredAuthDataToken` is set to `true`. The default value is `false`.

### Patches

Auth providers are now always validated on login, regardless of the `allowExpiredAuthDataToken` setting. The option `allowExpiredAuthDataToken` has been deprecated and will be removed in a future major version.

### Workarounds

Set `allowExpiredAuthDataToken` to `false` (the default) or remove the option from the server configuration.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / parse-server
Introduced in: 9.0.0 Fixed in: 9.6.0-alpha.41
Fix npm install parse-server@9.6.0-alpha.41
npm / parse-server
Introduced in: 0 Fixed in: 8.6.52
Fix npm install parse-server@8.6.52

References