{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/parse-server--8.6.102-9.0.0--9.10.5-alpha.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:parseplatform:parse_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-116163"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Parse Server (\u003c 8.6.102, 9.0.0 \u003c 9.10.5-alpha.2)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","web-application","cve-2026-116163"],"_cs_type":"advisory","_cs_vendors":["Parse Platform"],"content_html":"\u003cp\u003eParse Server contains an authentication bypass vulnerability (CVE-2026-116163) affecting custom adapters that subclass 'AuthAdapter'. Due to the failure to trigger the 'validateSetUp', 'validateLogin', and 'validateUpdate' methods, the system incorrectly defaults to accepting any 'authData' provided. This allows remote attackers to perform unauthorized actions including identity linking, account creation, and bypassing custom authentication factors.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized account creation, account takeover of existing users, and the bypassing of additional authentication mechanisms.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Parse Server to version 8.6.102 or later.\u003c/li\u003e\n\u003cli\u003eFor installations using the 9.x branch, upgrade to version 9.10.5-alpha.2 or later.\u003c/li\u003e\n\u003cli\u003eReview custom 'AuthAdapter' implementations to identify potential exposure.\u003c/li\u003e\n\u003cli\u003eAudit authentication logs for unusual 'authData' payloads or unexpected successful logins originating from non-standard authentication sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T14:32:04Z","date_published":"2026-10-25T14:32:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-parse-server-auth-bypass/","summary":"Parse Server versions prior to 8.6.102 and 9.0.0-9.10.5-alpha.2 contain an authentication bypass vulnerability allowing unauthenticated actors to sign up, link identities, or log in as existing users by providing arbitrary authData.","title":"Parse Server: Authentication bypass vulnerability (CVE-2026-116163)","url":"https://feed.craftedsignal.io/briefs/2026-10-parse-server-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Parse Server (\u003c 8.6.102, 9.0.0 \u003c 9.10.5-Alpha.2)","version":"https://jsonfeed.org/version/1.1"}