Low severityNVD Advisory· Published Oct 25, 2026

CVE-2026-116162

Description

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.

Affected products

Parse Community/Parse Serverllm-fuzzy
Range: <8.6.104, <9.10.5-alpha.5

Patches

Vulnerability mechanics

References

github.com/parse-community/parse-server/security/advisories/GHSA-9rh6-r4ph-367vnvd
www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.5-privilege-escalation-via-sms-mfa-loginnvd

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000