CVE-2026-32742
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
Published Mar 18, 2026 · updated Jun 17, 2026 · parseplatform parse-server
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields ( , , ) when creating a session object via . This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictable session token value. Starting in version 9.6.0-alpha.17 and 8.6.42, the session creation endpoint filters out server-generated fields from user-supplied data, preventing them from being overwritten. As a workaround, add a trigger on the class to validate and reject or strip any user-supplied values for , , and .
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 18, 2026 · NIST NVD
Detected
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields ( , , ) when creating a session object via . This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictab
Jun 17, 2026 · NIST NVD
Updated
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields ( , , ) when creating a session object via . This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictab
Affected
- cpe parseplatform/parse-serverversion unspecified
- cpe parseplatform/parse-server9.6.0
Sources
- CVE.orgVulnerability recordCVE-2026-32742
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-32742
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields ( , , ) when creating a session obj
nvd.nist.gov