Parse Server EUVD-2026-109424

Exploitation requires that the target Parse Server app be configured with a custom authentication adapter implemented as a subclass of Parse Server's exported AuthAdapter class that provides validateSetUp, validateLogin, and/or validateUpdate methods; for such a provider Parse Server never calls those methods and uses a base-class default that accepts any authData. Limiting factors per the advisory: apps using built-in adapters or custom adapters defined as plain objects (not subclasses) are NOT affected, which sharply narrows the exploitable population. Affected versions are Parse Server >= 9.0.0 < 9.10.5-alpha.2 and < 8.6.102. Workarounds stated by the vendor: implement all validation in an overridden validateAuthData method that does not rely on adapter instance state, or redefine the custom adapter as a plain object; otherwise upgrade to a fixed version.

This is a genuine high-priority issue for the specific population it affects, but that population is narrower than the 9.1 score alone suggests. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, unauthenticated bypass with high confidentiality and integrity impact, which matches an authentication-bypass CWE-287 that lets an attacker sign up, link identities, or log in as existing users. The vuln.today decision label is act_now and the finding comes from VulnCheck with a confirmed vendor (GHSA) advisory, which raises urgency. However, the 4.0 vector itself carries AT:P (an attack requirement), reflecting that exploitation is only possible when the target app is configured with a custom auth adapter subclassing AuthAdapter - the advisory explicitly states built-in adapters and plain-object custom adapters are NOT affected. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no signal of widespread or active exploitation; the references are vendor/VulnCheck advisories, not working exploit code. Net: treat as act_now for deployments known to use a custom AuthAdapter subclass; for all other Parse Server deployments the real-world risk is effectively nil despite the critical score.

A Parse Server app configures a custom authentication adapter that extends the exported AuthAdapter class to enforce credential checks or an extra authentication factor. Because Parse Server never invokes that subclass's validateSetUp/validateLogin/validateUpdate methods and falls back to a base-class default that accepts any authData, a remote attacker submits arbitrary authData to the sign-up or login endpoint and is authenticated as a new or existing user without valid credentials. No public working exploit code is identified at time of analysis; only vendor advisories are referenced.