Parse Server’s Google, Apple, and Facebook authentication adapters validate identity tokens using JWT verification, but when the adapter’s audience configuration option is unset, the verification routine silently skips checking the audience claim. This omission means a validly signed JWT issued for a different application can be accepted, allowing an attacker to authenticate as any user on the target Parse Server and gain full access to the server’s resources.

The vulnerability applies to Parse Server deployments that use the default Google, Apple, or Facebook authentication adapters without explicitly setting the audience value. Releases older than 8.6.10 or 9.5.0‑alpha.11 are affected; those versions and later contain the fix.

The CVSS score of 9.3 classifies the flaw as critical, and the EPSS score of < 1 % indicates a very low but non‑zero probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by sending a crafted authentication request to the Parse Server endpoint that contains a validly signed JWT issued for another application. The attacker only needs a correctly signed token and does not require additional privileges. Based on the description, it is inferred that the attack vector is network‑based and relies on the standard authentication mechanism of Parse Server.