CVE-2026-30965: Critical Session Token Leak in Parse Server

CVE-2026-30965 is a critical authorization flaw (CVSS 9.1) in Parse Server before 8.6.21 and 9.5.2-alpha.8. The redirectClassNameForKey query parameter can be abused to exfiltrate session tokens of other users. Upgrade to 8.6.21 or 9.5.2-alpha.8.

What's affected

Parse Server versions before 8.6.21 on the 8.x line and before 9.5.2-alpha.8 on the 9.x line are affected.

The record says exploitation requires the attacker to create or update an object with a new relation field, which depends on the Class-Level Permissions of at least one class.

How to check if you're exposed

Check your installed version:

npm ls parse-server

Then review your Class-Level Permissions. A class that lets unauthenticated or low privilege users create or update objects, including adding relation fields, is the precondition the record describes.

What to do now

1. Upgrade to Parse Server 8.6.21 or 9.5.2-alpha.8 or later.
2. Tighten Class-Level Permissions so public clients cannot add new fields or relations unless they must.
3. Invalidate sessions after upgrading, because exfiltrated tokens remain valid until they expire or are revoked.
4. Watch for sessions used from unfamiliar places.

Why it matters

The weakness class is CWE-863, incorrect authorization. Query handling let a client steer which class a relation key points to, which let data be read that the caller was never meant to see, namely session tokens.

A session token is a bearer credential, so holding one is enough to act as the user. The record says exfiltrated tokens can be used to take over accounts. It does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Parse Server security advisory GHSA-6r2j-cxgf-495f
• Parse Server 8.6.21 release
• NVD record for CVE-2026-30965

Last reviewed: 19 October 2026.