Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-z7cb-6ruj-4bf2
Vulnerability ID VCID-z7cb-6ruj-4bf2
Aliases CVE-2025-30168
GHSA-837q-jhwx-cmpv
Summary Parse Server has an OAuth login vulnerability The 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse Server apps. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, the credentials stored by one app can be used to authenticate the same user in the other app. Note that this only affects Parse Server apps that specifically use an affected 3rd party authentication provider for user authentication, for example by setting the Parse Server option `auth` to configure a Parse Server authentication adapter. See the [3rd party authentication docs](https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication) for more information on which authentication providers are affected.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-287 Improper Authentication
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00195 https://api.first.org/data/v1/epss?cve=CVE-2025-30168
epss 0.00195 https://api.first.org/data/v1/epss?cve=CVE-2025-30168
epss 0.00195 https://api.first.org/data/v1/epss?cve=CVE-2025-30168
cvssv3.1 6.9 https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication
generic_textual MODERATE https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication
ssvc Track https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication
cvssv3.1 6.9 https://github.com/parse-community/parse-server
generic_textual MODERATE https://github.com/parse-community/parse-server
cvssv3.1 6.9 https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e
generic_textual MODERATE https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e
ssvc Track https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e
cvssv3.1 6.9 https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f
generic_textual MODERATE https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f
ssvc Track https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f
cvssv3.1 6.9 https://github.com/parse-community/parse-server/pull/9667
generic_textual MODERATE https://github.com/parse-community/parse-server/pull/9667
ssvc Track https://github.com/parse-community/parse-server/pull/9667
cvssv3.1 6.9 https://github.com/parse-community/parse-server/pull/9668
generic_textual MODERATE https://github.com/parse-community/parse-server/pull/9668
ssvc Track https://github.com/parse-community/parse-server/pull/9668
cvssv3.1 6.9 https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv
generic_textual MODERATE https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv
ssvc Track https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv
cvssv3.1 6.9 https://nvd.nist.gov/vuln/detail/CVE-2025-30168
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-30168
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-30168
https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication
https://github.com/parse-community/parse-server
https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e
https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f
https://github.com/parse-community/parse-server/pull/9667
https://github.com/parse-community/parse-server/pull/9668
CVE-2025-30168 https://nvd.nist.gov/vuln/detail/CVE-2025-30168
GHSA-837q-jhwx-cmpv https://github.com/advisories/GHSA-837q-jhwx-cmpv
GHSA-837q-jhwx-cmpv https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N Found at https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-21T15:12:30Z/ Found at https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N Found at https://github.com/parse-community/parse-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N Found at https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-21T15:12:30Z/ Found at https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N Found at https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-21T15:12:30Z/ Found at https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N Found at https://github.com/parse-community/parse-server/pull/9667
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-21T15:12:30Z/ Found at https://github.com/parse-community/parse-server/pull/9667
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N Found at https://github.com/parse-community/parse-server/pull/9668
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-21T15:12:30Z/ Found at https://github.com/parse-community/parse-server/pull/9668
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-21T15:12:30Z/ Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-30168
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.41304
EPSS Score 0.00195
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:23:38.608435+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/parse-server/CVE-2025-30168.yml 38.6.0