{"id":"CVE-2026-116162","kind":"vulnerability","aliases":["CVE-2026-116162"],"related":[],"title":"Parse Server: SMS MFA login request saves fields with master privileges","description":"Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.","summary":"Parse Server saves the whole login request with master-key privileges when it issues an SMS multi-factor verification code. A user enrolled in SMS MFA can add extra fields to that request and change restricted fields on their own account, such as the email-verified flag.","severity":"low","cvss":2.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node","package","parse-server","self-hosted","sms-mfa"],"not_affected_if":["no-sms-mfa","patched-version"],"how_to_check":"- Check the installed `parse` or `parse-server` version in `package.json` or the lockfile and compare it with the fixed versions.\n- Confirm whether SMS MFA is enabled for your users in the Parse Server auth configuration.","fix":"- Upgrade `parse-server` 8.x to `8.6.104` or later.\n- Upgrade `parse-server` 9.x to `9.10.5-alpha.5` or later; 9.0.0 is not fixed.","status":"open","published_at":"2026-10-25T14:16:54+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:44:21+00:00","updated_at":"2026-10-25T14:44:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:44:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `parse-server` 8.x to `8.6.104` or later.\n- Upgrade `parse-server` 9.x to `9.10.5-alpha.5` or later; 9.0.0 is not fixed.","reach":"internet","title":"Parse Server: SMS MFA login request saves fields with master privileges","impact":"low","summary":"Parse Server saves the whole login request with master-key privileges when it issues an SMS multi-factor verification code. A user enrolled in SMS MFA can add extra fields to that request and change restricted fields on their own account, such as the email-verified flag.","category":"package","nicknames":[],"who_cares":["parse-server","self-hosted","node","sms-mfa"],"confidence":0.7,"needs_auth":"yes","worst_case":"Enrolled user alters restricted fields on their own account, such as email verification.","analyst_note":"","how_to_check":"- Check the installed `parse` or `parse-server` version in `package.json` or the lockfile and compare it with the fixed versions.\n- Confirm whether SMS MFA is enabled for your users in the Parse Server auth configuration.","needs_analyst":false,"not_affected_if":["patched-version","no-sms-mfa"],"who_is_affected":"Applications running Parse Server 8 before 8.6.104 or 9 before 9.10.5-alpha.5 that use SMS multi-factor authentication for user logins are exposed. Deployments without SMS MFA enrolled users, or on patched versions, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000614,"input_tokens":3353,"output_tokens":558,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116162':14A,17A '-2026':13A,16A '8.6.104':82C '9.0.0':84C '9.10.5':86C 'account':71B,129C 'add':58B 'alpha.5':87C 'authent':103C 'beforesav':139C 'beforesave-protect':138C 'chang':65B 'code':50B,105C 'cve':12A,15A 'email':76B,134C 'email-verif':133C 'email-verifi':75B 'enrol':53B,110C 'entir':90C 'extra':59B,114C 'factor':48B,102C 'field':8A,60B,67B,115C,125C 'flag':78B,136C 'host':25B 'includ':113C 'issu':43B,97C 'key':39B,123C 'login':5A,34B,91C 'master':10A,38B,94C,122C 'master-key':37B 'master-key-restrict':121C 'mfa':4A,28B,56B,109C 'mfa-enrol':108C 'modifi':120C 'multi':47B,101C 'multi-factor':46B,100C 'node':18B 'packag':19B 'pars':1A,21B,29B,79C 'parse-serv':20B 'privileg':11A,40B,95C 'protect':140C 'request':6A,35B,63B,92C,118C 'restrict':66B,124C 'save':7A,31B,88C 'self':24B 'self-host':23B 'server':2A,22B,30B,80C 'sms':3A,27B,45B,55B,99C,107C 'sms-mfa':26B 'user':52B,111C 'valu':141C 'verif':49B,104C,135C 'verifi':77B 'whole':33B","nicknames":[],"mitigations":[],"who_affected":"Applications running Parse Server 8 before 8.6.104 or 9 before 9.10.5-alpha.5 that use SMS multi-factor authentication for user logins are exposed. Deployments without SMS MFA enrolled users, or on patched versions, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116162","severity":null,"published_at":"2026-10-25T14:16:54+00:00","modified_at":"2026-10-25T14:16:54+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}