CVE-2026-116163

Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

State: Published
Severity: 9.1 Critical
Published: Oct 25, 2026
Updated: Oct 26, 2026
Reserved: Oct 25, 2026

Description

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

Scores

CVSS	Score	Vector	Source
4.0	9.1 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	VulnCheck

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
parse-serverparse-community	9.0.0 to before 9.10.5-alpha.2Affected 9.10.5-alpha.2Not affected
parse-serverparse-community	before 8.6.102Affected 8.6.102Not affected

References

GitHub Security Advisory (GHSA-rq3w-5c6f-p7wr)vendor-advisory
VulnCheck Advisory: Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclassesthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.