Vulnerability Description
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c
- https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.2-au
FAQ
What is CVE-2026-116163?
CVE-2026-116163 is a vulnerability with a CVSS score of 7.4 (HIGH). Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAd...
How severe is CVE-2026-116163?
CVE-2026-116163 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116163?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.