CVE-2026-116163High· 7.4▾ TwilightParse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inheri…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
parse-server >= 9.0.0 < 9.10.5-alpha.2parse-server < 8.6.102Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101042Medium· 6.4Parse Server is an open-source backend server
CVE-2026-87806High· 7.4Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter
CVE-2026-116162Low· 2.1Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
CVE-2026-116165High· 8.8Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
CVE-2026-116161Medium· 6.0Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions
CVE-2026-116164Medium· 6.3Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes