CVE-2026-30863 is a critical authentication flaw (CVSS 9.8) in Parse Server before 8.6.10 and 9.5.0-alpha.11. When the audience option is not set for the Google, Apple or Facebook adapters, token checks skip the audience claim. Upgrade to 8.6.10 or 9.5.0-alpha.11 and set the option.
What's affected
Parse Server versions before 8.6.10 on the 8.x line and before 9.5.0-alpha.11 on the 9.x line are affected.
The risk applies to deployments using the Google, Apple or Facebook authentication adapters without the audience configuration set. That means clientId for Google and Apple and appIds for Facebook.
How to check if you're exposed
List the installed version in your project:
npm ls parse-server
Then open your Parse Server configuration and look at the auth section. For each of the Google, Apple and Facebook adapters, check whether clientId or appIds is present. If an adapter is enabled and the value is missing, the audience check is being skipped.
What to do now
- Upgrade to Parse Server 8.6.10 or 9.5.0-alpha.11 or later.
- Set
clientIdfor the Google and Apple adapters andappIdsfor the Facebook adapter to your own application identifiers. - Disable any social login adapter you do not use.
- Review sign in logs for logins you cannot match to a real user session.
Why it matters
The weakness classes are CWE-287, improper authentication, and CWE-863, incorrect authorization. A signed JWT carries an audience claim that says which application the token was issued for. If the server never compares it with its own identifier, a validly signed token issued to a different application is accepted.
The record says this allows an attacker to authenticate as any user on the target server. The signature is real, so the check that passes is not the one that matters. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Does this affect email and password logins?
The record limits it to the Google, Apple and Facebook adapters. Other login methods are not described as affected.
Is upgrading enough?
Upgrade, and also set the audience options so the check has a value to compare against. The record ties the problem to that option being unset.
Sources
Last reviewed: 19 October 2026.
