Parse Server: Authentication bypass vulnerability (CVE-2026-116163)
Parse Server versions prior to 8.6.102 and 9.0.0-9.10.5-alpha.2 contain an authentication bypass vulnerability allowing unauthenticated actors to sign up, link identities, or log in as existing users by providing arbitrary authData.
CVE search metadata
CVE search record: CVE-2026-116163. Severity: high. CVSS: 7.4. KEV: no. Product: Parse Server (< 8.6.102, 9.0.0 < 9.10.5-alpha.2). Brief: Parse Server: Authentication bypass vulnerability (CVE-2026-116163). Brief link: https://feed.craftedsignal.io/briefs/2026-10-parse-server-auth-bypass/
Triage facts
Revision 1- Applicability
- Parse Server (< 8.6.102, 9.0.0 < 9.10.5-alpha.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 25, 14:32 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Parse Server contains an authentication bypass vulnerability (CVE-2026-116163) affecting custom adapters that subclass 'AuthAdapter'. Due to the failure to trigger the 'validateSetUp', 'validateLogin', and 'validateUpdate' methods, the system incorrectly defaults to accepting any 'authData' provided. This allows remote attackers to perform unauthorized actions including identity linking, account creation, and bypassing custom authentication factors.
Impact
Successful exploitation allows for unauthorized account creation, account takeover of existing users, and the bypassing of additional authentication mechanisms.
Recommendation
- Upgrade Parse Server to version 8.6.102 or later.
- For installations using the 9.x branch, upgrade to version 9.10.5-alpha.2 or later.
- Review custom 'AuthAdapter' implementations to identify potential exposure.
- Audit authentication logs for unusual 'authData' payloads or unexpected successful logins originating from non-standard authentication sources.
Immediate actions
Patch Parse Server to 8.6.102 or 9.10.5-alpha.2
Threat Hunt
Search authentication logs for anomalous authData fields or repeated attempts to link new identities to existing user accounts
Data: Application logs capturing Parse Server authentication events and authData payloads
Mitigations
Upgrade Parse Server to 8.6.102 or later
CVE-2026-116163