The vulnerability is a race condition (CWE‑362) caused by Parse Server’s OAuth2 adapter exporting a singleton instance across all OAuth2 provider configurations. When concurrent authentication requests for different providers occur, token validation may use another provider’s configuration, allowing a token that should be rejected by one provider to be accepted under a different provider’s policy. This results in an authentication bypass that could let an attacker obtain access or elevated privileges.

Affected deployments are those running parse-community:parse-server versions older than 8.6.37 or 9.6.0‑alpha.11. Specifically, all releases prior to 8.6.37 and alpha releases alpha1 through alpha10 of 9.6.0 are impacted. Systems configured with multiple OAuth2 providers via the oauth2: true flag are vulnerable, as the singleton is reused across providers. The CPE list identifies affected packages such as parse-platform:parse-server with unspecified or alpha10 versions.

The issue carries a CVSS score of 9.1 (High) and an EPSS score of less than 1%, indicating low current exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is remote authentication through the OAuth2 endpoint; an attacker could trigger concurrent requests to provoke the race condition and achieve credential bypass. Prompt remediation is required to mitigate this significant risk.