CVE-2026-116164

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that cla...

CVE-2026-116165

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal SCHE...

CVE-2026-116161

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped...

CVE-2026-116162

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their ow...

EUVD-2026-109426

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal SCHE...

CVE-2026-116165

Parse Server versions before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 are vulnerable to a missing authorization flaw on MongoDB deployments. This allows unauthenticated attackers to send REST API delete requests targeting the internal _SCHEMA collection. Successful exploitation enables the deletio...

CVE-2026-116164

Parse Server versions before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 are vulnerable to a Reserved Field Name Injection via object writes. The root cause is the failure to reject reserved internal field names during client object writes, allowing attackers to store or clear internal fields. This c...

CVE-2026-116164 Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that cla...

EUVD-2026-109425

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that cla...

CVE-2026-116163

Parse Server versions before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 are vulnerable to an authentication bypass via custom adapters subclassing AuthAdapter . The root cause is that the validateSetUp, validateLogin, and validateUpdate methods of these custom adapters are never invoked, causing the...

CVE-2026-116163 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

CVE-2026-116163 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

EUVD-2026-109424

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

CVE-2026-116162

Parse Server versions prior to 8.6.104 and 9.0.0 before 9.10.5-alpha.5 are vulnerable to Privilege Escalation via SMS MFA Login. The root cause is that the server saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-en...

CVE-2026-116161

Parse Server versions prior to 8.6.103 and 9.0.0 before 9.10.5-alpha.4 are vulnerable to an information disclosure vulnerability in the LiveQuery component. The root cause is that the subscription hash omits constraints (such as the _Session owner filter and beforeSubscribe constraints) when a $o...

CVE-2026-116162 Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their ow...

EUVD-2026-109422

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped...

EUVD-2026-109423

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their ow...

PT-2026-123006

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.101 Parse Server versions 9.0.0 through 9.10.4-alpha.3 Description Missing authorization on MongoDB deployments allows clients without the master key to delete the stored schema of any class. Unauthenticated...

PT-2026-123004

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.102 Parse Server versions prior to 9.10.5-alpha.2 Description An authentication bypass exists in custom adapters that subclass AuthAdapter. The issue occurs because the validateSetUp, validateLogin, and...