Reserved Field Name Injection in Parse Server by Parse Community

CVE-2026-116164

What is CVE-2026-116164?

The Parse Server vulnerability allows attackers to exploit the system by using restricted internal field names when writing client objects. This can lead to the disruption of MongoDB queries for all users by forcing reads of objects to fail or grant attackers the ability to override account lockout states and password histories, effectively bypassing key security policies. Such exploitation compromises the integrity of the server's functionality and puts user accounts at risk.

References