Parse Server OAuth2 Authentication Adapter App ID Validation Vulnerability

A vulnerability exists in the Parse Server OAuth2 authentication adapter, specifically in versions 9.0.0 prior to 9.6.0-alpha.13 and 8.0.2 prior to 8.6.39. The issue arises when the appidField and appIds are configured, as the adapter fails to properly validate app IDs. This misvalidation leads to a malformed value being sent to the token introspection endpoint instead of the user's actual access token. Depending on the introspection endpoint's response, this could either cause all OAuth2 logins to fail or improperly allow authentication from disallowed app contexts by returning valid-looking data for the malformed request.

Impact

This vulnerability can disrupt OAuth2 login processes or, conversely, enable unauthorized authentication in certain app contexts.

Remediation

Users can upgrade to Parse Server versions 9.6.0-alpha.13 or 8.6.39 to address this vulnerability.