Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-116163EUVD-2026-109424

Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 9.10.5-alpha.2, 8.6.102
Public exploit
None on Exploit-DB

Summary

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

Affected versions

  • parse-community parse-server

    From 9.0.0 · fixed in 9.10.5-alpha.2

  • parse-community parse-server

    fixed in 8.6.102

References 2

GitHub · parse-community/parse-server

vulncheck.com