PT-2026-25982 · Parse · Parse Server

7Azimo01 · Published 2026-03-17 · Updated 2026-03-20 · CVE-2026-32742

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.17 Parse Server versions prior to 8.6.42

Description An authenticated user can overwrite server-generated session fields (sessionToken, expiresAt, createdWith) when creating a session object via the POST /classes/ Session API endpoint. This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date and allows setting a predictable session token value. The sessionToken, expiresAt, and createdWith are vulnerable parameters.

Recommendations Versions prior to 9.6.0-alpha.17: Upgrade to version 9.6.0-alpha.17 or later. Versions prior to 8.6.42: Upgrade to version 8.6.42 or later. As a workaround for all affected versions, add a beforeSave trigger on the Session class to validate and reject or strip any user-supplied values for sessionToken, expiresAt, and createdWith.

Exploit

Fix

Weakness Enumeration

CWE-915

Related Identifiers

BIT-PARSE-2026-32742

CVE-2026-32742

GHSA-5V7G-9H8F-8PGG

Affected Products

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32742.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-5v7g-9h8f-8pgg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5v7g-9h8f-8pgg · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-32742 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32742 · Security Note
• https://github.com/parse-community/parse-server/pull/10196 · Note
• https://github.com/parse-community/parse-server/pull/10195 · Note
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/CVEnew/status/2034520418900377880 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034416647964971227 · Twitter Post