Product
Parse Server versions prior to 8.6.102 and 9.0.0-9.10.5-alpha.2 contain an authentication bypass vulnerability allowing unauthenticated actors to sign up, link identities, or log in as existing users by providing arbitrary authData.