1718 matches found
CVE-2026-32269
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value ...
CVE-2026-32242 Parse Server OAuth2 adapter shares mutable state across providers via singleton instance
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent...
CVE-2026-32242
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent...
GHSA-2CJM-2GWV-M892 Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's...
BIT-PARSE-2026-30967 Parse Server OAuth2 authentication adapter account takeover via identity spoofing
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2. and 8.6.22, the OAuth2 authentication adapter, when configured without the useridField option, only verifies that a token is active via the provider's token introspection...
CVE-2026-32269: Function Call With Incorrect Order of Arguments
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value ...
CVE-2026-32242: Concurrent Execution using Shared Resource with Improper Synchronization
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent...
AZL-79673 CVE-2026-3783 affecting package curl for versions less than 8.11.1-6
When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with eithe...
CVE-2026-3783 token leak with redirect and netrc
When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with eithe...
CVE-2026-3783 token leak with redirect and netrc
When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with eithe...
Insufficiently Protected Credentials
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the OAuth2 authentication process when the useridField option is not set. An attacke...
CVE-2026-3783: Insufficiently Protected Credentials
When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with eithe...
Linux Distros Unpatched Vulnerability : CVE-2026-3783
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second...
@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-29792 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)
@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-29792 Source advisory: OSV:GHSA-WG9X-QFGW-PXHJ...
CVE-2026-30967 Parse Server OAuth2 authentication adapter account takeover via identity spoofing
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, the OAuth2 authentication adapter, when configured without the useridField option, only verifies that a token is active via the provider's token introspectio...
GO-2026-4586 OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling in github.com/OliveTin/OliveTin
OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling in github.com/OliveTin/OliveTin. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: wal-g, argo-rollouts, prometheus-alertmanager, sftpgo-plugin-eventstore, volume-modifier-for-k8s, terraform-provider-random, apache-exporter, neuvector-sigstore-interface, k8s-device-plugin, mesosphere-vsphere-csi, tfsec, crossplane-provider-aws-route53,...
CVE-2026-27142 vulnerabilities
Vulnerabilities for packages: wal-g, argo-rollouts, prometheus-alertmanager, sftpgo-plugin-eventstore, volume-modifier-for-k8s, terraform-provider-random, apache-exporter, neuvector-sigstore-interface, k8s-device-plugin, mesosphere-vsphere-csi, tfsec, crossplane-provider-aws-route53,...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: argo-rollouts, apache-exporter, kubewatch, timestamp-authority, tfsec, crossplane-provider-aws-route53, maru, restic, cadvisor, nri-mongodb, crossplane-provider-aws-kms, conjur-cli, mods, telegraf, kpt, kafka-proxy, git-sync, terraform-provider-kubernetes, opencost,...
GHSA-J3GX-2473-5FP8 vulnerabilities
Vulnerabilities for packages: argo-rollouts, apache-exporter, kubewatch, timestamp-authority, tfsec, crossplane-provider-aws-route53, maru, restic, cadvisor, nri-mongodb, crossplane-provider-aws-kms, conjur-cli, mods, telegraf, kpt, kafka-proxy, git-sync, terraform-provider-kubernetes, opencost,...