BIT-parse-2026-116163

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/parse/BIT-parse-2026-116163.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-parse-2026-116163
Aliases
Published
2026-10-30T15:35:44Z
Modified
2026-10-30T20:55:59Z
Summary
Parse Server 9.0.0 before 9.10.5 Authentication Bypass via AuthAdapter Subclasses
Details

Parse Server before 8.6.102 and 9.0.0 before 9.10.5 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*"
    ],
    "severity":  "Critical"
}
References

Affected packages

Bitnami / parse

Package

Name
parse
Purl
pkg:bitnami/parse

Severity

  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.6.102
Introduced
9.0.0
Fixed
9.10.5

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/parse/BIT-parse-2026-116163.json"