Parse Server's code-based authentication adapters for providers such as GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, and Weibo verify authorization codes with the external provider during signup and provider linking, but fail to do so during login when authentication data is supplied with username and password. This allows a low-privileged authenticated user to attach an arbitrary, unverified provider identity to their account, effectively spoofing an external identity trusted by application logic. Additionally, an attacker can pre-hijack accounts by claiming a provider ID before the legitimate user links it, causing the victim's later sign-in with that provider to resolve to the attacker's account. The vulnerability affects deployments using these code-based auth adapters in versions >=8.0.2 <8.6.91 and >=9.0.0 <9.10.1-alpha.10. The issue is resolved in versions 8.6.91 and 9.10.1-alpha.10 by verifying credentials on login and rejecting provider IDs already linked to other users.

An attacker with low privileges can link unverified external provider identities to their own account, potentially bypassing application logic that trusts these linked identities. They can also preemptively claim provider IDs to hijack accounts when victims later link those providers. This undermines authentication integrity and can lead to unauthorized access or account takeover scenarios in affected Parse Server deployments using the vulnerable adapters.

A fix is available in Parse Server versions 8.6.91 and 9.10.1-alpha.10, which enforce credential verification on login and prevent linking provider IDs already associated with other users. Users should upgrade to these fixed versions. As a workaround, disabling the affected code-based authentication adapters can mitigate the issue until an upgrade is possible.