CVE-2026-32742: Parse Server session creation endpoint allows overwriting server-generated session fields

March 17, 2026 (updated March 19, 2026)

An authenticated user can overwrite server-generated session fields (sessionToken, expiresAt, createdWith) when creating a session object via POST /classes/_Session. This allows bypassing the server’s session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictable session token value.

References

github.com/advisories/GHSA-5v7g-9h8f-8pgg
github.com/parse-community/parse-server
github.com/parse-community/parse-server/pull/10195
github.com/parse-community/parse-server/pull/10196
github.com/parse-community/parse-server/security/advisories/GHSA-5v7g-9h8f-8pgg
nvd.nist.gov/vuln/detail/CVE-2026-32742

Code Behaviors & Features

Detect and mitigate CVE-2026-32742 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →