Parse Server Authentication Bypass via Custom Adapter Validation

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Parse Server versions before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contain a critical authentication bypass vulnerability where custom authentication adapter validation methods are never invoked. Instead, a permissive default implementation accepts arbitrary authData, allowing attackers to bypass authentication controls entirely. This vulnerability affects any organization using Parse Server with custom authentication adapters, including those deploying Parse Server in containerized environments, backend-as-a-service configurations, or hybrid cloud setups. The impact is severe because attackers can sign up with forged credentials, link arbitrary identities to existing accounts, impersonate legitimate users, or completely circumvent additional authentication factors like MFA—effectively gaining unauthorized access to protected resources and user accounts.

Casky's 283 matching skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious authentication patterns including: unexpected authData payloads lacking proper validation signatures, successful authentication events from accounts without corresponding credential setup in custom adapters, and account linking operations that bypass secondary verification steps. The platform's skills would surface indicators such as authentication requests with malformed or missing validator calls, anomalous login sequences from new identities created via authData injection, and privilege escalation attempts following successful authentication bypass. These findings enable security teams to correlate raw logs and behavioral anomalies with the underlying validation failure, distinguishing this authentication bypass from standard brute-force or credential stuffing attacks.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-116163.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-116163

Casky has 283 skills that investigate the attack patterns behind CVE-2026-116163. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn