CVE-2026-32742: Parse Server Session Creation Endpoint Vulnerability
Summary
CVE-2026-32742: Parse Server session creation endpoint allows overwriting server-generated session fields. Affects parse-server across 2 version ranges.
< 8.6.42
>= 9.0.0, < 9.6.0-alpha.17
Fixed in 8.6.42 or 9.6.0-alpha.17, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-32742 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that enables developers to build applications with a robust server-side infrastructure. It provides features such as data storage, user authentication, and real-time notifications. However, it has a vulnerability in its session creation endpoint that allows authenticated users to manipulate server-generated session fields.
Vulnerability Detail
The vulnerability arises from the ability of authenticated users to overwrite server-generated session fields, specifically 'sessionToken', 'expiresAt', and 'createdWith', when creating a session object via the POST /classes/_Session endpoint. This can lead to serious security issues, including the ability to bypass session expiration policies by setting arbitrary expiration dates and creating predictable session tokens, which can be exploited for unauthorized access.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.428.6.42npm install parse-server@8.6.42 -
>= 9.0.0, < 9.6.0-alpha.179.6.0-alpha.17npm install parse-server@9.6.0-alpha.17
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, implement a 'beforeSave' trigger on the _Session class to validate and reject or strip any user-supplied values for 'sessionToken', 'expiresAt', and 'createdWith'. Here is an example of how to implement this trigger:
Parse.Cloud.beforeSave('_Session', (request) => {
const session = request.object;
if (session.get('sessionToken') || session.get('expiresAt') || session.get('createdWith')) {
session.unset('sessionToken');
session.unset('expiresAt');
session.unset('createdWith');
}
});
Conclusion
In summary, CVE-2026-32742 is a significant vulnerability in Parse Server that allows users to manipulate session fields, posing security risks. It is crucial to update to the latest patched versions or implement workarounds to mitigate potential threats.
See every vulnerability recorded for parse-server →
FAQ
CVE-2026-32742 is a vulnerability in Parse Server that allows authenticated users to overwrite server-generated session fields, potentially leading to unauthorized access.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The risks include bypassing session expiration policies and creating predictable session tokens, which can lead to unauthorized access to user accounts.
If immediate updates are not possible, implement the suggested workaround by adding a 'beforeSave' trigger to the _Session class to prevent overwriting of critical fields.
The CVSS score of this vulnerability is 4.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
