CVE-2026-116163: Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Q: Which deployments are affected?

Deployments using Parse Server before 8.6.102, or versions from 9.0.0 before 9.10.5-alpha.2, are affected when they use a custom authentication adapter that subclasses AuthAdapter.

Q: What must an attacker have to exploit this issue?

The vector is network-accessible and requires neither prior privileges nor user interaction. Exploitation has high attack complexity, but an attacker can provide arbitrary authData where the vulnerable custom adapter is used.

Q: Does this affect installations that do not use custom AuthAdapter subclasses?

The described bypass is specific to custom adapters subclassing AuthAdapter. It occurs because their validateSetUp, validateLogin, and validateUpdate methods are not called and the inherited default accepts authData.

Q: How can administrators identify whether their authentication flow is exposed?

Review custom authentication adapters that subclass AuthAdapter and determine whether they rely on validateSetUp, validateLogin, or validateUpdate to reject invalid authData or enforce additional authentication factors. Those validation methods are not invoked on affected versions.

Q: What version should be deployed to address the issue?

Upgrade Parse Server to 8.6.102 or later, or to 9.10.5-alpha.2 or later for the 9.x release line.

Published Oct 25, 2026

Updated

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

Affected Software

1 affected component

Parse Platform Parse Server<8.6.102, >=9.0.0<9.10.5-alpha.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Parse Server to a version that resolves this vulnerability.
Fixed in 8.6.102
Upgrade
Upgrade Parse Server to a version that resolves this vulnerability.
Fixed in 9.10.5-alpha.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using Parse Server before 8.6.102, or versions from 9.0.0 before 9.10.5-alpha.2, are affected when they use a custom authentication adapter that subclasses AuthAdapter.

What must an attacker have to exploit this issue?

The vector is network-accessible and requires neither prior privileges nor user interaction. Exploitation has high attack complexity, but an attacker can provide arbitrary authData where the vulnerable custom adapter is used.

Does this affect installations that do not use custom AuthAdapter subclasses?

The described bypass is specific to custom adapters subclassing AuthAdapter. It occurs because their validateSetUp, validateLogin, and validateUpdate methods are not called and the inherited default accepts authData.

How can administrators identify whether their authentication flow is exposed?

Review custom authentication adapters that subclass AuthAdapter and determine whether they rely on validateSetUp, validateLogin, or validateUpdate to reject invalid authData or enforce additional authentication factors. Those validation methods are not invoked on affected versions.

What version should be deployed to address the issue?

Upgrade Parse Server to 8.6.102 or later, or to 9.10.5-alpha.2 or later for the 9.x release line.

CVE-2026-116163: Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker have to exploit this issue?

Does this affect installations that do not use custom AuthAdapter subclasses?

How can administrators identify whether their authentication flow is exposed?

What version should be deployed to address the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker have to exploit this issue?

Does this affect installations that do not use custom AuthAdapter subclasses?

How can administrators identify whether their authentication flow is exposed?

What version should be deployed to address the issue?