{"id":"CVE-2026-116163","kind":"vulnerability","aliases":["CVE-2026-116163"],"related":[],"title":"Parse Server: custom auth adapters skip checks, letting attackers log in","description":"Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.","summary":"Parse Server custom authentication adapters that subclass AuthAdapter never run their validateSetUp, validateLogin, or validateUpdate methods, so an inherited default accepts any authData. An attacker can sign up, link identities, log in as existing users, or skip extra authentication factors.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["custom-auth","node.js","package","parse-server","self-hosted"],"not_affected_if":["built-in-auth-only"],"how_to_check":"- Check the Parse Server version with `npm ls parse-server` and confirm whether it is below `8.6.102` or in the `9.0.0` to `9.10.5-alpha.2` range.\n- Search the project for classes that extend `AuthAdapter` and see whether they override `validateSetUp`, `validateLogin`, and `validateUpdate`.","fix":"- Upgrade parse-server to `8.6.102` or later on the 8.x line, or to `9.10.5-alpha.2` or later on the 9.x line.\n- Until upgraded, override validateSetUp, validateLogin, and validateUpdate in every custom AuthAdapter so they reject unexpected authData.","status":"open","published_at":"2026-10-25T14:16:55+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:42:08+00:00","updated_at":"2026-10-25T14:42:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:42:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade parse-server to `8.6.102` or later on the 8.x line, or to `9.10.5-alpha.2` or later on the 9.x line.\n- Until upgraded, override validateSetUp, validateLogin, and validateUpdate in every custom AuthAdapter so they reject unexpected authData.","reach":"internet","title":"Parse Server: custom auth adapters skip checks, letting attackers log in","impact":"high","summary":"Parse Server custom authentication adapters that subclass AuthAdapter never run their validateSetUp, validateLogin, or validateUpdate methods, so an inherited default accepts any authData. An attacker can sign up, link identities, log in as existing users, or skip extra authentication factors.","category":"package","nicknames":[],"who_cares":["parse-server","node.js","self-hosted","custom-auth"],"confidence":0.7,"needs_auth":"no","worst_case":"Attackers log in as existing users and bypass extra authentication factors.","analyst_note":"Confirm from the NVD entry or the Parse Server advisory which auth adapters are affected and whether the default-config case is exposed.","how_to_check":"- Check the Parse Server version with `npm ls parse-server` and confirm whether it is below `8.6.102` or in the `9.0.0` to `9.10.5-alpha.2` range.\n- Search the project for classes that extend `AuthAdapter` and see whether they override `validateSetUp`, `validateLogin`, and `validateUpdate`.","needs_analyst":true,"not_affected_if":["built-in-auth-only"],"who_is_affected":"Applications running Parse Server with a custom authentication adapter that subclasses AuthAdapter are exposed, because the inherited default is what accepts the attacker's authData. Deployments using only built-in auth providers are not described as affected by the sources. Teams that run Parse Server as a backend should check their adapters.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000685,"input_tokens":3377,"output_tokens":694,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116163':13A,16A '-2026':12A,15A '8.6.102':71C '9.0.0':73C '9.10.5':75C 'accept':48B,101C 'adapt':5A,32B,90C 'addit':125C 'alpha.2':76C 'arbitrari':110C 'attack':9A,52B,107C 'auth':4A,19B 'authadapt':35B,92C 'authdata':50B,103C,111C 'authent':31B,66B,79C,126C 'bypass':80C 'call':95C 'check':7A 'contain':77C 'custom':3A,18B,30B,89C,124C 'custom-auth':17B 'cve':11A,14A 'default':47B,99C 'exist':61B,120C 'extra':65B 'factor':67B,127C 'host':27B 'ident':57B,116C 'inherit':46B,98C 'instead':106C 'let':8A 'link':56B,115C 'log':10A,58B,117C 'method':43B,87C 'never':36B,94C 'node.js':20B 'packag':21B 'pars':1A,23B,28B,68C 'parse-serv':22B 'run':37B 'self':26B 'self-host':25B 'server':2A,24B,29B,69C 'sign':54B,113C 'skip':6A,64B,123C 'subclass':34B,91C 'suppli':109C 'use':105C 'user':62B,121C 'validatelogin':40B,84C 'validatesetup':39B,83C 'validateupd':42B,86C","nicknames":[],"mitigations":[],"who_affected":"Applications running Parse Server with a custom authentication adapter that subclasses AuthAdapter are exposed, because the inherited default is what accepts the attacker's authData. Deployments using only built-in auth providers are not described as affected by the sources. Teams that run Parse Server as a backend should check their adapters.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116163","severity":null,"published_at":"2026-10-25T14:16:55+00:00","modified_at":"2026-10-25T14:16:55+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}