CVE-2026-32269

npm/parse-server CVE-2026-32269: medium

Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Action: Upgrade parse-server to 8.6.39 or later.

npm i parse-server@9.6.0-alpha.13

npm i parse-server@8.6.39

Affected

Fixed versions

Sources

• osv: GHSA-69xg-f649-w5g2
• https://github.com/parse-community/parse-server/security/advisories/GHSA-69xg-f649-w5g2
• https://nvd.nist.gov/vuln/detail/CVE-2026-32269
• https://github.com/parse-community/parse-server
• https://github.com/parse-community/parse-server/releases/tag/8.6.39
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.13

CVE-2026-32269 · published 2026-03-13T20:02:25Z · modified 2026-03-16T10:40:56.912017Z · JSON