Executive brief
Parse Server is a backend-as-a-service platform that handles user authentication and data storage for mobile and web applications. A vulnerability in its query handling allows attackers to steal session tokens of other users through a crafted query parameter, enabling account takeover. This can lead to unauthorized access to sensitive user data and unauthorized actions on behalf of compromised accounts.
Technical details
The vulnerability is an authorization bypass (CWE-863) in Parse Server's query handling mechanism. When an attacker exploits the `redirectClassNameForKey` query parameter, the server redirects queries to a different class without properly re-applying security checks. An attacker can create or update an object with a relation field to bypass class-level permission restrictions and exfiltrate session tokens. The attack requires the ability to create or update objects with new relation fields, which depends on Class-Level Permissions. No user interaction is required, and the vulnerability is accessible over the network with no privileges required. Patches are available in Parse Server 8.6.21 and 9.5.2-alpha.8; affected versions include all prior versions and 9.0.0-alpha.1 through 9.5.2-alpha.7.
Affected products
- Parse Community Parse Server before 8.6.21 and 9.0.0-alpha.1 to before 9.5.2-alpha.8
Timeline
- 2026-03-10: disclosed: Vulnerability publicly disclosed
- 2026-03-10: patched: Patches released: Parse Server 8.6.21 and 9.5.2-alpha.8