---
id: CVE-2026-116163
title: >-
  Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter
  Subclasses
summary: >-
  Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an
  authentication bypass because the validateSetUp, validateLogin, and
  validateUpdate methods of custom adapters subclassing AuthAdapter are never
  called, and an inheri…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-287
vendor: parse-community
product: parse-server
affected:
  - parse-server >= 9.0.0 < 9.10.5-alpha.2
  - parse-server < 8.6.102
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T13:20:07.658Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116163'
references:
  - url: >-
      https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr
    label: GitHub Security Advisory (GHSA-rq3w-5c6f-p7wr)
  - url: >-
      https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.2-authentication-bypass-via-authadapter-subclasses
    label: >-
      VulnCheck Advisory: Parse Server 9.0.0 before 9.10.5-alpha.2
      Authentication Bypass via AuthAdapter Subclasses
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.949Z'
---

## Overview

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

## Affected

- `parse-server >= 9.0.0 < 9.10.5-alpha.2`
- `parse-server < 8.6.102`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.