HIGHCVSS v3.1 7.4Vulnerability
CVE-2026-116163
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-10-25T14:48:34.194958+00:00
- Cvss severity
- HIGH
- Cvss score
- 7.4
- Retrieved at
- 2026-10-25T14:49:38+00:00
- Score
- 7.4
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-116163
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- First seen by Signal
- 2026-10-25T14:49:38+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Published at
- 2026-10-25T14:16:55.110
- Last modified
- 2026-10-25T14:16:55.110
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph