GHSA-pfj7-wv7c-22pr Parse Server has an auth provider validation bypass on login via partial authData

• npm parse-server: >= 9.0.0, < 9.6.0-alpha.41 → fixed in 9.6.0-alpha.41 • npm parse-server: < 8.6.52 → fixed in 8.6.52

Impact An authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token. This affects Parse Server deployments where the server option `allowExpiredAuthDataToken` is set to `true`. The default value is `false`. Patches Auth providers are now always validated on login, regardless of the `allowExpiredAuthDataToken` setting. The option `allowExpiredAuthDataToken` has been deprecated and will be removed in a future major version. Workarounds Set `allowExpiredAuthDataToken` to `false` (the default) or remove the option from the server configuration.