CVE-2026-116162

Parse Server versions prior to 8.6.104 and 9.0.0 before 9.10.5-alpha.5 are vulnerable to Privilege Escalation via SMS MFA Login. The root cause is that the server saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-en...