CVE-2026-32242

Workarounds

There is no known workaround. If only a single OAuth2 provider is configured, the race condition cannot occur.

References

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-2cjm-2gwv-m892
• Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.11
• Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.37

Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's configuration, potentially allowing a token that should be rejected by one provider to be accepted because it is validated against a different provider's policy.

Deployments that configure multiple OAuth2 providers via the oauth2: true flag are affected.

Multiple concurrent operations access a shared resource without proper synchronization, producing unpredictable results depending on timing. Typical impact: TOCTOU exploits, data corruption, or privilege escalation.

Kodem intelligence

The fix ensures that a new adapter instance is created for each provider instead of reusing the singleton, so each provider's configuration is isolated.

1. What is CVE-2026-32242? CVE-2026-32242 is a critical-severity race condition vulnerability in parse-server (npm), affecting versions >= 9.0.0, < 9.6.0-alpha.11. It is fixed in 9.6.0-alpha.11, 8.6.37. Multiple concurrent operations access a shared resource without proper synchronization, producing unpredictable results depending on timing.
2. Which versions of parse-server are affected by CVE-2026-32242? parse-server (npm) versions >= 9.0.0, < 9.6.0-alpha.11 is affected.
3. Is there a fix for CVE-2026-32242? Yes. CVE-2026-32242 is fixed in 9.6.0-alpha.11, 8.6.37. Upgrade to this version or later.
4. Is CVE-2026-32242 exploitable, and should I be worried? Whether CVE-2026-32242 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-32242 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-32242?
   • Upgrade parse-server to 9.6.0-alpha.11 or later
   • Upgrade parse-server to 8.6.37 or later

Other vulnerabilities in parse-server