CVE-2026-32742: Parse Server session creation endpoint allows overwriting server-generated session fields
Impact
An authenticated user can overwrite server-generated session fields (sessionToken, expiresAt, createdWith) when creating a session object via POST /classes/Session. This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictable session token value.
Patches
The session creation endpoint now filters out server-generated fields from user-supplied data, preventing them from being overwritten.
Workarounds
Add a beforeSave trigger on the Session class to validate and reject or strip any user-supplied values for sessionToken, expiresAt, and createdWith.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields (sessionToken, expiresAt, createdWith) when creating a session object via POST /classes/Session. This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictable session token value. Starting in version 9.6.0-alpha.17 and 8.6.42, the session creation endpoint filters out server-generated fields from user-supplied data, preventing them from being overwritten. As a workaround, add a beforeSave trigger on the Session class to validate and reject or strip any user-supplied values for sessionToken, expiresAt, and createdWith.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32742?
CVE-2026-32742 has a high severity rating due to the potential for authenticated users to manipulate session expirations.
How do I fix CVE-2026-32742?
To fix CVE-2026-32742, upgrade to parse-server version 8.6.42 or 9.6.0-alpha.17 or later.
What are the risks associated with CVE-2026-32742?
The risks of CVE-2026-32742 include unauthorized persistence of user sessions beyond intended expiration times.
Who is affected by CVE-2026-32742?
CVE-2026-32742 affects users of specific versions of the parse-server through their session management functionalities.
What functionality is compromised by CVE-2026-32742?
CVE-2026-32742 compromises the server's session expiration policy, allowing users to set arbitrary future expiration dates.