Authentication Bypass in Parse Server Affects Users' Security
CVE-2026-116163

9.1CRITICAL

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116163?

The vulnerability allows attackers to bypass authentication mechanisms in Parse Server versions prior to 8.6.102 and between 9.0.0 and 9.10.5-alpha.2. Due to the failure of the validateSetUp, validateLogin, and validateUpdate methods to be invoked for custom adapters subclassing AuthAdapter, the system resorts to an inherited default method that accepts any authData. Consequently, this flaw enables unauthorized individuals to create accounts, link identities, or gain access to existing user sessions without proper credentials or additional authentication factors.

Affected Version(s)

parse-server 9.0.0 < 9.10.5-alpha.2

parse-server 0 < 8.6.102

parse-server 9.10.5-alpha.2

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://www.vulncheck.com/advisories/parse-server-9.0.0-b...
third-party-advisory

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mtrezza
.