fix: Authentication provider credentials are usable across Parse Server apps; fixes security vulnerability [GHSA-837q-jhwx-cmpv](https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv) (#9667)

This commit is contained in:
Manuel
2025-03-21 10:49:09 +01:00
committed by GitHub
parent c56b2c49b2
commit 5ef0440c8e
59 changed files with 5987 additions and 1680 deletions

View File

@@ -69,6 +69,17 @@ class CheckGroupServerConfig extends CheckGroup {
}
},
}),
new Check({
title: 'Insecure auth adapters disabled',
warning:
"Attackers may explore insecure auth adapters' vulnerabilities and log in on behalf of another user.",
solution: "Change Parse Server configuration to 'enableInsecureAuthAdapters: false'.",
check: () => {
if (config.enableInsecureAuthAdapters !== false) {
throw 1;
}
},
}),
];
}
}