Parse Server (< 8.6.102, 9.0.0 < 9.10.5-Alpha.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/parse-server--8.6.102-9.0.0--9.10.5-alpha.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 14:32:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgParse Server: Authentication bypass vulnerability (CVE-2026-116163)https://feed.craftedsignal.io/briefs/2026-10-parse-server-auth-bypass/Sun, 25 Oct 2026 14:32:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-parse-server-auth-bypass/Parse Server versions prior to 8.6.102 and 9.0.0-9.10.5-alpha.2 contain an authentication bypass vulnerability allowing unauthenticated actors to sign up, link identities, or log in as existing users by providing arbitrary authData.Parse Server contains an authentication bypass vulnerability (CVE-2026-116163) affecting custom adapters that subclass 'AuthAdapter'. Due to the failure to trigger the 'validateSetUp', 'validateLogin', and 'validateUpdate' methods, the system incorrectly defaults to accepting any 'authData' provided. This allows remote attackers to perform unauthorized actions including identity linking, account creation, and bypassing custom authentication factors.

Impact

Successful exploitation allows for unauthorized account creation, account takeover of existing users, and the bypassing of additional authentication mechanisms.

Recommendation

  • Upgrade Parse Server to version 8.6.102 or later.
  • For installations using the 9.x branch, upgrade to version 9.10.5-alpha.2 or later.
  • Review custom 'AuthAdapter' implementations to identify potential exposure.
  • Audit authentication logs for unusual 'authData' payloads or unexpected successful logins originating from non-standard authentication sources.
]]>highadvisoryauthentication-bypassweb-applicationcve-2026-116163