Paper/Archive/CVE-2026-116163

CVE-2026-116163

parse-community parse-server — Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

EPSS 0.3%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 20.7.207 × 204.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

Affected

ProductAffectedFixed inSource

parse-server9.0.0 – < 9.10.5-alpha.29.10.5-alpha.2CNA

parse-server< 8.6.1028.6.102CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr writeupvulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.2-authentication-bypass-via-authadapter-subclasses