Back to Database
Status published
High
CVE-2022-24901
Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
Vulnerability Description
Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24901
Credits & Attribution
No credits recorded in the NVD database.
More from parse-community
View All →CVE-2025-68150
Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter
High
8.3
CVE-2025-68115
Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables
Medium
5.3
CVE-2025-67727
Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management
Medium
6.9
CVE-2025-64502
Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details
Medium
6.9
CVE-2025-64430
Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
High
7.5
Affected Vendor
parse-community
View all reports →Affected Software
parse-server
Vulnerable Versions:
< 4.10.10, >= 5.0.0, < 5.2.1
Timeline
Official Publish:
May 4th, 2022
Last Modified:
April 23rd, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
MITRE ATT&CK TTPs
T1557
Adversary-in-the-Middle
Credential Access
T1040
Network Sniffing
Collection
T1552
Unsecured Credentials
Credential Access
T1071
Application Layer Protocol
Command and Control
T1565
Data Manipulation
Impact
T1190
Exploit Public-Facing Application
Initial Access
T1078
Valid Accounts
Persistence
T1556
Modify Authentication Process
Credential Access