Executive brief
Parse Server is a backend framework for building scalable applications with user authentication and data management. An authenticated user can override server-controlled session fields (session token, expiration date, creation metadata) when creating a new session, potentially bypassing session expiration policies or creating predictable session tokens that could be reused or forged.
Technical details
The vulnerability is a mass assignment / improper attribute filtering issue (CWE-915) in Parse Server's session creation endpoint. When an authenticated user creates a session object via POST /classes/_Session, the server fails to filter out or protect sensitive, server-generated fields (sessionToken, expiresAt, createdWith) from user-supplied input. An attacker can craft a request that includes arbitrary values for these fields, bypassing the server's session expiration policy by setting an artificial far-future date, or setting a predictable session token value. The attack vector is network-based and requires authentication (PR:L), making it a moderate-severity integrity issue. Patches are available in parse-server versions 9.6.0-alpha.17 (for 9.x) and 8.6.42 (for 8.x), which now filter out server-generated fields during session creation.
Affected products
- Parse Community parse-server 9.0.0 to <9.6.0-alpha.17; all versions prior to 8.6.42
Timeline
- 2026-03-17: disclosed: Advisory published
- 2026-03-13: patched: Fix merged for parse-server 9.x (PR #10195) and 8.x (PR #10196)