CVE-2026-32742: Parse Server Auth Bypass Vulnerability

CVE-2026-32742 Overview

CVE-2026-32742 is a session field overwrite vulnerability in Parse Server, an open source backend that can be deployed to any infrastructure that runs Node.js. This vulnerability allows an authenticated user to overwrite server-generated session fields (sessionToken, expiresAt, createdWith) when creating a session object via POST /classes/_Session. The flaw enables attackers to bypass the server's session expiration policy by setting an arbitrary far-future expiration date and allows setting predictable session token values.

Critical Impact

Authenticated attackers can bypass session expiration policies and potentially create predictable session tokens, undermining authentication security controls in Parse Server deployments.

Affected Products

• Parse Server versions prior to 8.6.42
• Parse Server versions 9.6.0-alpha1 through 9.6.0-alpha16
• parseplatform parse-server for Node.js

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-32742 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32742

Vulnerability Analysis

This vulnerability is classified under CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), commonly known as mass assignment. The core issue lies in the session creation endpoint's failure to properly filter out server-controlled fields from user-supplied input data.

When an authenticated user creates a session object through the POST /classes/_Session endpoint, the server accepts and processes all fields provided in the request body without adequate validation. This includes server-generated fields that should never be user-controllable: sessionToken, expiresAt, and createdWith. By exploiting this oversight, an attacker can craft malicious requests that set these protected fields to arbitrary values.

The security implications are significant. An attacker can set expiresAt to a date far in the future, creating sessions that effectively never expire and persist indefinitely. Additionally, the ability to specify predictable sessionToken values could facilitate session fixation attacks or make brute-force session hijacking more feasible.

Root Cause

The root cause is improper input validation in the session creation endpoint. The Parse Server failed to implement server-side filtering of protected session fields before processing user-submitted data. The application trusted client-supplied data for fields that should exclusively be generated and controlled by the server, violating the principle of never trusting user input for security-critical values.

Attack Vector

The attack requires network access and low-privilege authentication. An attacker with valid credentials to the Parse Server instance can exploit this vulnerability by sending a crafted POST request to the /classes/_Session endpoint. The request includes malicious values for server-generated fields such as a custom sessionToken or a far-future expiresAt timestamp.

The attack does not require special privileges beyond basic authentication, and no user interaction is needed beyond the attacker's own actions. The vulnerability is exploitable remotely over the network, making it accessible to any authenticated user who can reach the Parse Server API.

Detection Methods for CVE-2026-32742

Indicators of Compromise

• Session objects in the _Session class with expiresAt dates set abnormally far into the future (e.g., years beyond standard session duration)
• Session tokens with predictable or non-random patterns that deviate from server-generated token formats
• Unusual POST requests to /classes/_Session containing sessionToken, expiresAt, or createdWith fields in the request body

Detection Strategies

• Implement API request logging to capture and analyze all requests to the /classes/_Session endpoint
• Create alerts for session creation requests that include protected fields (sessionToken, expiresAt, createdWith) in the request body
• Periodically audit the _Session collection for sessions with anomalous expiration dates or creation metadata

Monitoring Recommendations

• Monitor Parse Server access logs for repeated session creation attempts from single users
• Set up database-level monitoring to detect sessions with expiresAt values exceeding organizational policy limits
• Review authentication patterns for accounts creating multiple persistent sessions

How to Mitigate CVE-2026-32742

Immediate Actions Required

• Upgrade Parse Server to version 8.6.42 or 9.6.0-alpha.17 or later immediately
• Audit existing sessions in the _Session class for suspicious expiresAt values or unusual sessionToken patterns
• Invalidate and regenerate any sessions suspected of being created through exploitation
• Review API access logs for evidence of exploitation attempts

Patch Information

The Parse Server maintainers have released security patches that address this vulnerability. Version 8.6.42 provides the fix for the stable 8.x branch, while version 9.6.0-alpha.17 addresses the issue in the 9.x alpha series. The patches implement server-side filtering that removes sessionToken, expiresAt, and createdWith fields from user-supplied data before processing session creation requests.

For additional technical details, refer to GitHub Pull Request #10195 and GitHub Pull Request #10196. The full security advisory is available at GitHub Security Advisory GHSA-5v7g-9h8f-8pgg.

Workarounds

• Implement a beforeSave trigger on the _Session class to validate and reject or strip user-supplied values for sessionToken, expiresAt, and createdWith fields
• Apply network-level restrictions to limit access to the Parse Server API to trusted sources only
• Consider implementing additional authentication controls such as IP allowlisting for sensitive operations

// Workaround: beforeSave trigger for _Session class
Parse.Cloud.beforeSave('_Session', (request) => {
  // Strip server-generated fields from user input
  const protectedFields = ['sessionToken', 'expiresAt', 'createdWith'];
  
  if (!request.master) {
    protectedFields.forEach(field => {
      if (request.object.has(field) && request.object.dirty(field)) {
        request.object.unset(field);
      }
    });
  }
});