{"schema":"threatline.record/2","record":{"id":"GHSA-rq3w-5c6f-p7wr","aliases":["GHSA-rq3w-5c6f-p7wr"],"summary":"Custom auth adapters that extend the AuthAdapter class accept any authData","details":"### Impact\n\nA custom authentication adapter that extends Parse Server's exported `AuthAdapter` class and implements the `validateSetUp`, `validateLogin` and `validateUpdate` methods, as the class documentation describes, never had those methods called. Parse Server instead used a default inherited from the base class, which accepts any authentication data. For a provider served by such an adapter, an attacker can sign up, link an identity, or log in as an existing user without valid credentials for that provider, and can skip a custom adapter that implements an additional authentication factor. Only apps that configure a custom authentication adapter built as a subclass of `AuthAdapter` are affected; built-in adapters and custom adapters defined as plain objects are not affected.\n\n### Patches\n\nMethods that an adapter inherits unchanged from the `AuthAdapter` base class are no longer treated as implemented, so a subclass's own validation methods run, and the adapter's own `beforeFind` method is now also called. The methods of a custom adapter that is a class instance now run on a per-request copy of the configured instance, so they can use its state and helper methods. A subclass that implements only some of `validateSetUp`, `validateLogin` and `validateUpdate` is now rejected as not configured instead of accepting any authentication data. In Parse Server 8, unlinking an authentication provider also no longer calls the adapter's `beforeFind` method, as in Parse Server 9.\n\n### Workarounds\n\nImplement all validation in an overridden `validateAuthData` method of the subclass that does not rely on the adapter instance's own state, or define the custom adapter as a plain object with the validation methods instead of a subclass of `AuthAdapter`.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10773\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10774\n","categories":["Unclassified"],"product":"parse-server","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr","source_modified_at":"2026-10-10T02:04:34Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"npm","name":"parse-server"},"range":">= 9.0.0, < 9.10.5-alpha.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr","source_modified_at":"2026-10-10T02:04:34Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"npm","name":"parse-server"},"range":"< 8.6.102"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr","source_modified_at":"2026-10-10T02:04:34Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"9.10.5-alpha.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr","source_modified_at":"2026-10-10T02:04:34Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"8.6.102"}],"cvss":9.1,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-10T02:04:34Z","modified_at":"2026-10-10T02:04:34Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-10T02:04:34Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-10T02:04:34Z","content_hash":"a69d32f075dcc91b7f8a28f5e940e8c059199205ae48afd6023ba21c520fa06d"}}