Parse Server: Authentication bypass via custom AuthAdapter subclasses
Summary
Parse Server, a Node.js backend, does not call the validation methods of custom authentication adapters that subclass AuthAdapter. Instead, an inherited default accepts any authData. An unauthenticated remote attacker can therefore sign up, link identities, log in as existing users or skip additional authentication factors. Only deployments with a custom AuthAdapter subclass are affected; built-in adapters and plain-object adapters are not.
Affected
- parse-server 9.0.0 up to (excluding) 9.10.5-alpha.2
- parse-server before 8.6.102
- Only deployments with a custom authentication adapter that subclasses AuthAdapter
Fixed in
- parse-server 8.6.102 (8.x line)
- parse-server 9.10.5-alpha.2 (9.x line)
- Note: OSV lists the 9.x fix as 9.10.5 without the alpha suffix; confirm the exact version in the vendor advisory.
Workaround
- Implement all validation in an overridden validateAuthData method of the subclass that does not rely on the adapter instance's own state, or
- define the custom adapter as a plain object with the validation methods instead of a subclass of AuthAdapter
- Note: these are not vendor-endorsed mitigations; upgrading is the real fix.
Exploitation
- CVSS 4.0 base score 9.1 (network attack, no privileges, no user interaction)
- CISA SSVC: exploitation none, not automatable, total technical impact
- No public proof-of-concept or known exploitation found in the sources checked; not confirmed against CISA KEV
Our recommendation
- Inventory all Parse Server instances, including npm lockfiles and container images, and check for versions below 8.6.102 or 9.x below 9.10.5-alpha.2
- Check whether any custom adapter extends AuthAdapter; if so, prioritise the patch
- Patch, then review accounts created or linked via custom authentication for unexpected entries
- Recheck NVD and CISA KEV in the coming days, as the NVD status was still Awaiting Analysis
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rq3w-5c6f-p7wr github.com
- VulnCheck Advisory www.vulncheck.com
- OSV BIT-parse-2026-116163 osv.dev
- Fix PR #10773 (9.x) github.com
- Fix PR #10774 (8.x) github.com
- Release 8.6.102 github.com
- VulDB CVE-2026-116163 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:25.
Original description (NVD)
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.