CVE-2026-30965: Parse Server Session Token Exfiltration Vulnerability
Summary
CVE-2026-30965: Parse Server session token exfiltration via redirectClassNameForKey query parameter. Affects parse across 2 version ranges.
< 8.6.21
>= 9.0.0, < 9.5.2
Fixed in 8.6.21 or 9.5.2, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-30965 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that allows developers to build applications with a robust server-side infrastructure using Node.js. It provides features such as data storage, user authentication, and real-time notifications. However, it has been found to have a critical vulnerability that can lead to session token exfiltration, potentially compromising user accounts.
Vulnerability Detail
Prior to versions 9.5.2-alpha.8 and 8.6.21, Parse Server had a vulnerability in its query handling mechanism. This flaw allows both authenticated and unauthenticated attackers to exploit the 'redirectClassNameForKey' query parameter to exfiltrate session tokens of other users. The exfiltrated tokens can be used to take over user accounts, leading to unauthorized access and data breaches. The vulnerability requires the attacker to create or update an object with a new relation field, which is contingent on the Class-Level Permissions of at least one class.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.6.218.6.21 -
>= 9.0.0, < 9.5.29.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict the use of the 'redirectClassNameForKey' query parameter in your application until the update is applied. This may involve modifying your application logic to prevent unauthorized access to this parameter.
Conclusion
The CVE-2026-30965 vulnerability in Parse Server poses a significant risk by allowing session token exfiltration. It is essential for users to update to the latest patched versions to mitigate this risk and protect user accounts from unauthorized access.
See every vulnerability recorded for parse →
FAQ
CVE-2026-30965 is a vulnerability in Parse Server that allows attackers to exfiltrate session tokens through a specific query parameter.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
If exploited, this vulnerability can lead to unauthorized access to user accounts, allowing attackers to manipulate or steal sensitive data.
Yes, the vulnerability has been fixed in versions 8.6.21 and 9.5.2-alpha.8 of Parse Server.
If immediate updating is not possible, consider implementing a temporary workaround by restricting the use of the 'redirectClassNameForKey' query parameter.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
