What’s Vulnerable › Vulnerabilities

CVE-2026-116163: Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-25 · updated 2026-10-26
• Weakness: CWE-287

Description

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

Affected products

• parse-community parse-server: from 9.0.0 before 9.10.5-alpha.2 — fixed in 9.10.5-alpha.2

How to fix

Upgrade to a fixed version: parse-community parse-server 9.10.5-alpha.2. Check the vendor advisory for mitigations.

References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr
• https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.2-authentication-bypass-via-authadapter-subclasses

Get alerted when CVE-2026-116163 or the next vulnerability affects your stack