The OAuth2 authentication adapter fails to verify that a token matches the user ID supplied in authData.id when the useridField option is omitted. Consequently, any attacker who possesses a valid OAuth2 token from the same provider can forge authentication requests as any target user. This flaw enables complete hijacking of user accounts, allowing unauthorized modification of personal data and access to sensitive information, and can also increase privileges if the account has elevated rights. The weakness is a classic authentication failure (CWE-287).

This vulnerability affects Parse Server deployments that use the generic OAuth2 authentication adapter with oauth2:true and do not configure the useridField setting. All versions prior to 9.5.2-alpha.9 (8.x series) and prior to 8.6.22 (9.x series) are impacted. The affected environment is the open‑source Parse Server application running on Node.js.

The CVSS score of 7.6 indicates significant severity, while the EPSS score of <1% suggests that, up to the present, attacks are infrequent. The vulnerability is not listed in the CISA KEV catalog, so no large‑scale exploits are known. An attacker needs only a valid OAuth2 token from the provider, which may be obtained through phishing, credential stuffing, or compromised client credentials. With such a token, the attacker can send an authenticated request that bypasses identity checks and assumes the target user’s identity, leading to full account takeover and compromising protected system components that rely on OAuth2 authentication.