---
id: "CVE-2026-116163"
kind: "vulnerability"
aliases: ["CVE-2026-116163"]
title: "Parse Server: custom auth adapters skip checks, letting attackers log in"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["custom-auth", "node.js", "package", "parse-server", "self-hosted"]
not_affected_if: ["built-in-auth-only"]
published_at: "2026-10-25T14:16:55+00:00"
first_seen_at: "2026-10-25T14:41:22+00:00"
updated_at: "2026-10-25T14:42:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116163", "first_seen_at": "2026-10-25T14:41:22+00:00"}]
---

# Parse Server: custom auth adapters skip checks, letting attackers log in

Parse Server custom authentication adapters that subclass AuthAdapter never run their validateSetUp, validateLogin, or validateUpdate methods, so an inherited default accepts any authData. An attacker can sign up, link identities, log in as existing users, or skip extra authentication factors.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Parse Server version with `npm ls parse-server` and confirm whether it is below `8.6.102` or in the `9.0.0` to `9.10.5-alpha.2` range.
- Search the project for classes that extend `AuthAdapter` and see whether they override `validateSetUp`, `validateLogin`, and `validateUpdate`.

## Fix

- Upgrade parse-server to `8.6.102` or later on the 8.x line, or to `9.10.5-alpha.2` or later on the 9.x line.
- Until upgraded, override validateSetUp, validateLogin, and validateUpdate in every custom AuthAdapter so they reject unexpected authData.

## Timeline

- 2026-10-25T14:41:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116163

## From the sources

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_