Parse Server versions 9.0.0 through 9.10.1‑alpha.9 and 8.0.2 through 8.6.90 lack verification of external provider credentials when a user logs in with a username and password that also includes the provider identity. This flaw allows an authenticated attacker to attach an arbitrary, unverified provider account to their own account, or pre‑hijack a victim’s account by claiming that victim’s provider ID before the victim links the provider. The result is that application logic that trusts linked provider identities can be subverted, potentially granting the attacker unauthorized access or privileged actions. The weakness is a classic Authentication Bypass, identified as CWE-287.

The vulnerability affects installations of parse-server when any of the following code‑based authentication adapters are enabled: GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo. Affected releases include parse-server 9.0.0 up to but not including 9.10.1‑alpha.10 and parse-server 8.0.2 up to but not including 8.6.91. Deployments that do not use these adapters remain unaffected.

The CVSS score of 7.4 indicates a high severity with high impact. The EPSS score is not available, but the presence of the flaw in the login flow means that any user with an existing account could exploit it without external interaction. The flaw is not yet listed in the CISA KEV catalog, but its exploitation would allow credential spoofing and account takeover. Attackers could leverage automated scripts to link provider identities during the login process, and if the target application enforces provider trust for authorization, the attacker can bypass the intended authentication controls.