CVE-2026-116163

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.102 Parse Server versions 9.0.0 through 9.10.5-alpha.1

Description An authentication bypass exists because the validateSetUp(), validateLogin(), and validateUpdate() methods of custom adapters subclassing AuthAdapter are not executed. Instead, an inherited default is used that accepts any authData. This allows attackers to provide arbitrary authData to sign up, link identities, log in as existing users, or bypass custom additional authentication factors.

Recommendations Update to version 8.6.102 or later. Update to version 9.10.5-alpha.2 or later.