CVE-2026-101042 Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity

Parse Server is an open-source backend server. In versions = 9.0.0 = 8.0.2 8.6.91, the code-based authentication adapters GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo verify the client's authorization code with the external provider on signup and on...

CVE-2026-101042 Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity

Parse Server is an open-source backend server. In versions = 9.0.0 = 8.0.2 8.6.91, the code-based authentication adapters GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo verify the client's authorization code with the external provider on signup and on...

PYSEC-2025-111

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferredusername as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead...

CVE-2020-8300

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway mus...