Parse Server allows an attacker to authenticate as any user who has linked a third‑party provider when the server is configured to accept partially valid authentication data. By supplying only the provider identifier, an attacker can bypass normal credential checks and obtain a valid session token, granting full access to the target account. This is an authentication‑bypass flaw (CWE‑287) that can compromise confidentiality and integrity of user data.

The flaw affects open‑source Parse Server deployments from the parse-community project. Specifically, versions before 8.6.52 and 9.6.0‑alpha.41 are vulnerable when the allowExpiredAuthDataToken option is set to true. The default configuration is false, so the risk is tied to deployments that intentionally enable this option.

The vulnerability received a CVSS score of 7, indicating high severity, while the EPSS score is under 1%, suggesting a low likelihood of widespread exploitation. It is not listed in CISA’s KEV catalog. An attacker can exploit the flaw remotely by sending a crafted request to the login endpoint with a known provider ID, requiring no user credentials. Those who have enabled allowExpiredAuthDataToken are especially at risk, as the session token granted to the attacker can be used for any action the legitimate user is authorized to perform.