CVE-2026-116162

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.104 Parse Server versions 9.0.0 through 9.10.5-alpha.4

Description When issuing an SMS multi-factor authentication (MFA) verification code, the system saves the entire login request using master privileges. This allows a user enrolled in SMS MFA to include additional fields in the request to modify restricted fields on their own account, including the email-verification flag or values protected by beforeSave().

Recommendations Update Parse Server to version 8.6.104 or later. Update Parse Server to version 9.10.5-alpha.5 or later.