9.10.5

9.10.5 (2026-10-16)

Bug Fixes

• Custom auth adapters that extend the AuthAdapter class accept any authData (GHSA-rq3w-5c6f-p7wr) (#10773) (bee4082)
• Installation update is written to the installation named by the request's installation ID instead of the addressed object (GHSA-8j8q-73xx-w3m4) (#10792) (256a253)
• LiveQuery subscriptions using a $or query can receive another user's events, including session tokens (GHSA-349r-988w-x3jp) (#10776) (a7821c6)
• Login with master key overwrites stored MFA settings of user (#10771) (28bb53b)
• Malformed query operators $or, $and, $nor, $options cause internal server error (#10775) (c56ccdf)
• Object update returns the stored value of a field reverted in beforeSave to a caller without read access (GHSA-9rvr-f5hc-9f2f) (#10788) (0b33504)
• Object write with a crafted key can pollute a shared prototype and cause denial of service (GHSA-rx55-fw4j-pvpx) (#10790) (e895091)
• Object write with a dot notation key can skip afterSave triggers and LiveQuery events (GHSA-969q-274f-mc7w) (#10786) (6dab17c)
• Option requestKeywordDenylist does not apply to query parameters keys, include and excludeKeys (#10793) (e220f51)
• Relation $relatedTo query using an operator instead of an object ID bypasses owning-object ACL (GHSA-58m4-cqvw-4vgh) (#10783) (36af858)
• SMS MFA login code request saves other login request fields with master privileges (GHSA-9rh6-r4ph-367v) (#10781) (e2a1474)