# CVE-2026-116163: Parse Server authentication bypass in custom AuthAdapter

Source: https://junglewise.ai/threats/cve-2026-116163-parse-server-before-8-6-102-and-9-0-0-before-9-10-5-alpha-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-116163 · Severity: high · CVSS 7.4 · Published 2026-10-25

Parse Server is a backend framework that provides user authentication and data management for mobile and web applications. A vulnerability in versions before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 allows attackers to bypass custom authentication validators in AuthAdapter subclasses, meaning they can sign up without valid credentials, impersonate existing users, or skip additional authentication factors. This affects only applications using custom authentication adapters built as subclasses of AuthAdapter, not built-in adapters.

Technologies: [Parse Community Parse Server](https://junglewise.ai/threats/technologies/parse-community-parse-server). Vendors: [Parse Community](https://junglewise.ai/threats/vendors/parse-community).

## Quick answers

**Is CVE-2026-116163 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116163 being exploited in the wild.

**How severe is CVE-2026-116163?** High severity, with a CVSS score of 7.4, published 25 October 2026.

**Which products and versions are affected?** Parse Community Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2.

**Is there a fix for CVE-2026-116163?** Yes: fixed in Parse Server 8.6.102, 9.10.5-alpha.2. Until then: Implement all validation in an overridden validateAuthData method of the subclass that does not rely on the adapter instance's state, or define the custom adapter as a plain object with validation methods instead of a subclass of AuthAdapter. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116163 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116163?** Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Parse Server 8.6.102, 9.10.5-alpha.2

Implement all validation in an overridden validateAuthData method of the subclass that does not rely on the adapter instance's state, or define the custom adapter as a plain object with validation methods instead of a subclass of AuthAdapter.

## Technical details

Custom authentication adapters that extend Parse Server's AuthAdapter class should implement validateSetUp, validateLogin, and validateUpdate methods for validation, but these methods are never invoked. Instead, Parse Server uses a default inherited method that accepts any authData. An unauthenticated network attacker can supply arbitrary authData to bypass authentication checks, sign up, link identities, or log in as existing users without valid credentials. The vulnerability requires the application to use a custom AuthAdapter subclass; built-in adapters and plain object adapters are not affected.

## Affected products

- parse-community Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2

## Timeline

- 2026-10-10: disclosed
- 2026-10-25: advisory

## References

- [https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr](https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr)
- [https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.2-authentication-bypass-via-authadapter-subclasses](https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.2-authentication-bypass-via-authadapter-subclasses)

## Related threats

- [Parse Server email validation regex denial of service](https://junglewise.ai/threats/cve-2026-123487-parse-server-before-8-6-115-and-9-0-0-before-9-10-7-alpha-1)
- [Parse Server prototype pollution in Cloud Code and LiveQuery](https://junglewise.ai/threats/cve-2026-121965-parse-server-before-8-6-113-and-9-0-0-before-9-10-6-alpha-5)
- [Parse Server denial of service via dot notation object update](https://junglewise.ai/threats/cve-2026-121414-parse-server-before-8-6-110-and-9-0-0-before-9-10-6-alpha-2)
- [Parse Server prototype pollution denial of service](https://junglewise.ai/threats/cve-2026-119569-parse-server-before-8-6-108-and-9-0-0-before-9-10-5-alpha-9)
- [Parse Server $relatedTo query ACL bypass](https://junglewise.ai/threats/cve-2026-116801-parse-server-before-8-6-105-and-9-0-0-before-9-10-5-alpha-6-does)