CVE-2026-116163

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.102 Parse Server versions prior to 9.10.5-alpha.2

Description An authentication bypass exists in custom adapters that subclass AuthAdapter. The issue occurs because the validateSetUp(), validateLogin(), and validateUpdate() methods are not executed, causing the system to use an inherited default that accepts any authData. This allows attackers to provide arbitrary authData to sign up, link identities, log in as existing users, or bypass custom additional authentication factors.

Recommendations Update Parse Server to version 8.6.102 or later. Update Parse Server to version 9.10.5-alpha.2 or later.