PT-2026-25982 · Npm · Parse Server

Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-32742

OSV

CVSS v3.1

4.3

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Impact

An authenticated user can overwrite server-generated session fields (sessionToken, expiresAt, createdWith) when creating a session object via POST /classes/ Session. This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictable session token value.

Patches

The session creation endpoint now filters out server-generated fields from user-supplied data, preventing them from being overwritten.

Workarounds

Add a beforeSave trigger on the Session class to validate and reject or strip any user-supplied values for sessionToken, expiresAt, and createdWith.

Fix

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-32742

GHSA-5V7G-9H8F-8PGG

Affected Products

Parse Server

References · 5

• https://osv.dev/vulnerability/GHSA-5v7g-9h8f-8pgg · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/pull/10196 · Note
• https://github.com/parse-community/parse-server/pull/10195 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-5v7g-9h8f-8pgg · Note