What is CVE-2026-27804?

CVE-2026-27804 is a critical-severity vulnerability in Parse-Community Parse-Server, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 9.1/10. Published 2026-02-26.

How severe is CVE-2026-27804?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Parse-Community Parse-Server

CVE-2026-27804

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with `alg: "none"` to log in as any user linked to a Google account, without knowing their credentials. All deployments with Google authentication enabled are affected. The fix in versions 8.6.3 and 9.1.1-alpha.4 hardcodes the expected `RS256` algorithm instead of trusting the JWT header, and replaces the Google adapter's custom key fetcher with `jwks-rsa` which rejects unknown key IDs. As a workaround, dsable Google authentication until upgrading is possible.

Vulnerability class: POODLE (CVE-2014-3566)

Published 2026-02-26 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.002 (13.6th percentile), scored 2026-10-19.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 14th percentile — 13.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.001

Affected products

Parse-Community Parse-Server — versions >= 9.0.0, < 9.3.1-alpha.4, < 8.6.3
Parseplatform Parse-Server — versions 9.3.1

Weakness classification (CWE)

References

github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2 (Patch, Vendor Advisory)
github.com/parse-community/parse-server/commit/9b94083accb7f3e72c6b8126c195c7a0… (Patch)
github.com/parse-community/parse-server/commit/9d5942d50e55c822924c27b05aa98f13… (Patch)
github.com/parse-community/parse-server/releases/tag/8.6.3 (Release Notes)
github.com/parse-community/parse-server/releases/tag/9.3.1-alpha.4 (Release Notes)

Frequently asked questions

What is CVE-2026-27804?: CVE-2026-27804 is a critical-severity vulnerability in Parse-Community Parse-Server, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 9.1/10. Published 2026-02-26.
How severe is CVE-2026-27804?: Critical severity. CVSS v3 base score is 9.1 out of 10.