CVE-2026-116163GHSA-rq3w-5c6f-p7wr
parse-server: Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
parse-community parse-server
CVSS
9.1CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 2
1 outlet mention it. Reports are not confirmation; each links to its source.
- @stackflag.bsky.social: CVE-2026-116163 - parse-server The Parse Server software can be tricked into accepting any login information because custom authentication checks are not run. This lets attackers cBluesky: CVE posts, 25 Oct 2026
- @threatroundup.bsky.social: parse-community parse-server CVE-2026-116163 is rated critical, CVSS 9.1. Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass… No public eBluesky: CVE posts, 25 Oct 2026
Description
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
Text from CVE List
Affected versions 4
- parse-serveraffected: 9.0.0 before 9.10.5-alpha.2CVE List
- parse-serverunaffected: 9.10.5-alpha.2CVE List
- parse-serveraffected: all versions before 8.6.102CVE List
- parse-serverunaffected: 8.6.102CVE List