Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
ARETIQ Daily Vulnerability Bulletin — October 25, 2026 🔴 CRITICAL: CVE-2026-116163 (parse-community/parse-server) AAS 12.0 9 vulnerabilities — CRITICAL: 1, HIGH: 8 Full bulletin: https://aretiq.ai/bulletins/2026-10-25/
🚨 CVE published today: Parse Server auth bypass (CVE-2026-116163), CVSS 4.0 9.1 🔓 Custom AuthAdapter checks never run; any authData accepted ⚠️ Log in as existing users ✅ Fixed: 8.6.102 / 9.10.5-alpha.2 🔗 https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr #AppSec #NodeJS https://t.co/0Hs5dl9hc6
High-severity CVE-2026-116163 (CVSS 9.1) affects Parse Server with an authentication bypass. Review instances and apply updates if in use. https://nvd.nist.gov/vuln/detail/CVE-2026-116163 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/2daBU9L7zZ