CVE-2026-116163 in parse-server
Summary
by MITRE • 10/25/2026
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
Parse Server versions prior to 8.6.102 and the 9.0.0 series before version 9.10.5-alpha.2 contain a critical authentication bypass vulnerability rooted in the improper implementation of inheritance within its adapter architecture. The core technical flaw lies in how custom adapters that subclass AuthAdapter handle validation logic during user registration, identity linking, and login processes. Specifically, the methods validateSetUp, validateLogin, and validateUpdate are intended to be overridden by developers implementing custom authentication providers to enforce specific security checks or additional factors. However, due to a defect in the framework's method resolution order, these critical override methods are never invoked for subclasses of AuthAdapter. Instead, the system falls back to an inherited default implementation that blindly accepts any provided authData without performing necessary validation against external identity providers or custom business logic requirements.
This architectural oversight effectively neutralizes security controls implemented by developers who rely on extending the base AuthAdapter class. When a user attempts to sign up for a new account using a custom authentication provider, link an existing social identity to their Parse account, or log in with credentials managed through a custom adapter, the server does not execute the developer-defined validation routines. Consequently, any arbitrary authData structure submitted by an attacker is accepted as valid proof of identity. This behavior creates a severe gap between the intended security posture and the actual runtime enforcement mechanisms, allowing unauthenticated actors to bypass multi-factor authentication schemes or proprietary access control policies that were supposed to be enforced at this layer.
The operational impact of this vulnerability is profound, leading directly to unauthorized account takeover and privilege escalation. Attackers can exploit this flaw to log in as existing users by supplying fabricated authData that mimics valid credentials from a supported identity provider without actually possessing the real secrets or tokens associated with those accounts. Furthermore, attackers can create new user accounts under arbitrary identities or link malicious external identities to legitimate victim accounts, thereby gaining persistent access and potentially escalating privileges if the linked account has administrative rights. This bypass undermines the integrity of the entire authentication pipeline, rendering custom security implementations ineffective and exposing sensitive application data to unauthorized access.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to adequately verify the identity of users attempting to gain access. It also maps closely to ATT&CK technique T1078 Valid Accounts, where adversaries use legitimate credentials or forged authentication tokens to maintain persistence and move laterally within a target environment. The failure to invoke custom validation logic represents a significant deviation from secure coding practices regarding inheritance and polymorphism in security-critical code paths.
To mitigate this risk, organizations running affected versions of Parse Server must upgrade immediately to version 8.6.102 or higher for the legacy branch, or version 9.10.5-alpha.2 and later for the development branch where these method calls have been corrected. Until an upgrade is feasible, administrators should consider implementing a reverse proxy or API gateway that performs strict validation of authentication requests before they reach the Parse Server instance, although this is not a substitute for fixing the underlying application logic. Developers utilizing custom AuthAdapter subclasses must review their code to ensure no critical security dependencies rely on these specific methods until patches are applied, and audit logs should be monitored closely for anomalies indicative of forged authData submissions attempting to exploit this bypass mechanism.