Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter

Description

A vulnerability in Parse Server’s query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other users by exploiting the redirectClassNameForKey query parameter. Exfiltrated session tokens can be used to take over user accounts.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **< 8.6.21

  >= 9.0.0-alpha.1, < 9.5.2-alpha.8**

• Patched version(s): **8.6.21

  9.5.2-alpha.8**

References

• GHSA-6r2j-cxgf-495f
• CVE-2026-30965
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL - CVE-2026-31856
• Parse Server crash via deeply nested query condition operators - CVE-2026-32944
• Parse Server has a password reset token single-use bypass via concurrent requests - CVE-2026-32943
• Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API - CVE-2026-30946

Tags:

npm

parse-server