CVE-2026-116163

Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Published Oct 25, 2026 CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

Analysis

Technical impact

Parse Server contains an authentication bypass that occurs when custom adapters subclass AuthAdapter do not invoke the validateSetUp, validateLogin, or validateUpdate methods. Instead, a generic inherited default method that accepts any authentication data is used, allowing attackers to supply arbitrary authentication data. This flaw permits attackers to sign up new accounts, link identities, log in as existing users, or bypass additional custom authentication factors.

Affected Systems

The vulnerability affects parse-server from the parse-community organization. Versions earlier than 8.6.102 and 9.0.0 earlier than 9.10.5-alpha.2 are susceptible.

Risk and Exploitability

The CVSS score of 9.1 indicates a critical severity and the vulnerability allows remote attackers to compromise user accounts without needing additional credentials. The EPSS score is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers likely exploit the flaw by submitting crafted requests that provide arbitrary authentication data to the affected endpoints. The ease of exploitation is high due to the lack of validation in the custom adapter subclass flow.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

parse-community

parse-server

unaffected

Version	Status	Constraints
`9.0.0`	affected	< 9.10.5-alpha.2
`9.10.5-alpha.2`	unaffected	—

parse-community

parse-server

unaffected

Version	Status	Constraints
`0`	affected	< 8.6.102
`8.6.102`	unaffected	—

No data.

Vendor Product Versions

Parse Community

Parse Server

Version	Status	Scheme	Platform
`[9.0.0,9.10.5-alpha.2)`	affected	semver	—
`9.10.5-alpha.2`	unaffected	semver	—

Parse Community

Parse Server

Version	Status	Scheme	Platform
`[0,8.6.102)`	affected	generic	—
`8.6.102`	unaffected	semver	—

Parseplatform

Parse-server

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade parse-server to a version that includes the fix (≥8.6.102 or ≥9.10.5-alpha.2).
If an upgrade cannot be performed immediately, modify custom AuthAdapter subclasses to explicitly call the parent validateSetUp, validateLogin, and validateUpdate methods, or implement equivalent authentication checks to prevent acceptance of arbitrary authData.
Disable or tightly restrict any exposed routes that allow signing up, linking identities, or logging in with arbitrary authentication data, and monitor authentication logs for suspicious activity.

Generated by OpenCVE AI on October 25, 2026 at 16:43 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.282% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.2-authentication-bypass-via-authadapter-subclasses

History

Oct 26, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 25, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Parse Community Parse Community parse Server
Vendors & Products		Parse Community Parse Community parse Server

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
Title		Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
First Time appeared		Parseplatform Parseplatform parse-server
Weaknesses		CWE-287
CPEs		cpe:2.3:a:parseplatform:parse-server::::::::
Vendors & Products		Parseplatform Parseplatform parse-server
References		https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.2-authentication-bypass-via-authadapter-subclasses
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 9.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`