CVE-2026-30863 – Parse Server JWT Audience Validation

Affected versions
Parse Server < 8.6.10 and < 9.5.0-alpha.11

Vulnerable components

• Google auth adapter (GoogleAuthAdapter)
• Apple auth adapter (AppleAuthAdapter)
• Facebook auth adapter (FacebookAuthAdapter)

Root cause
When the adapter is configured without setting the audience parameter (clientId for Google/Apple, appIds for Facebook), the underlying JWT verification (using jsonwebtoken or similar) skips audience claim checking. A valid JWT issued for any other application (with matching issuer and signature) is accepted as authentic.

Prerequisites for exploitation

• Target Parse Server uses at least one of: Google, Apple, or Facebook login