CVE-2026-30965: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30965 is a session token exfiltration vulnerability in Parse Server, an open-source Node.js backend platform, caused by incorrect authorization (CWE-863) in query handling via the redirectClassNameForKey query parameter. It affects all Parse Server versions prior to 8.6.21 (8.x branch) and versions 9.0.0 through 9.5.2-alpha.7 (9.x branch). The vulnerability was published on March 10, 2026, with patches released on March 8, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 9.9 (Critical) (GitHub Advisory, Github Advisory).

The root cause is an incorrect authorization check (CWE-863) in Parse Server's query redirect mechanism. When a query uses the redirectClassNameForKey parameter to redirect to another class, the server fails to apply the same Class-Level Permission (CLP) security checks that would normally govern direct access to the target class. This allows an attacker to craft a query that redirects to the _Session class (or similar protected classes) and exfiltrate session tokens belonging to other users. Exploitation requires the attacker to be able to create or update an object with a new relation field on at least one class — a condition that depends on the CLP configuration of the application. The fix enforces the same security checks on redirected queries as on direct queries to the target class (GitHub Advisory).

Successful exploitation allows an attacker to exfiltrate session tokens of other users, enabling full account takeover without requiring the victim's credentials or any user interaction. Compromised accounts can be used to access sensitive application data, modify records, and escalate privileges within the Parse Server application. Both confidentiality and integrity are rated High impact; availability is not affected. The vulnerability can be exploited by unauthenticated attackers if the application's Class-Level Permissions allow public creation of new relation fields, making the attack surface potentially very broad (GitHub Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.088% (0.046% per Feedly), placing it in the 25th percentile for exploitation probability within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The low attack complexity and lack of authentication requirements make it a candidate for future weaponization if a PoC is published.

1. Reconnaissance: Identify internet-facing Parse Server instances (8.x < 8.6.21 or 9.0.0 ≤ version < 9.5.2-alpha.8) by probing the Parse Server API endpoint (typically /parse/) and checking version information or response headers.
2. Assess Class-Level Permissions: Probe the target application to determine if any class allows public or unauthenticated creation/update of objects with new relation fields (i.e., addField is enabled for public or unauthenticated users).
3. Create or update a relation field: If permitted, create or update an object on an accessible class with a new relation field that points to a protected class (e.g., _Session).
4. Craft malicious query: Send a crafted HTTP GET or POST request to the Parse Server query API, using the redirectClassNameForKey parameter to redirect the query to the _Session class (or another protected class containing session tokens), bypassing the normal CLP checks.
5. Exfiltrate session tokens: Parse the API response, which will contain session tokens of other users due to the missing authorization enforcement on the redirected query.
6. Account takeover: Use the exfiltrated session tokens in subsequent API requests (e.g., setting the X-Parse-Session-Token header) to authenticate as the victim users and perform unauthorized actions on their behalf (GitHub Advisory).

• Network: Unusual API requests to the Parse Server query endpoint (e.g., /parse/classes/<ClassName>) containing the redirectClassNameForKey parameter, especially targeting _Session or other protected internal classes; repeated queries from a single IP or user agent probing multiple class redirects.
• Logs: Parse Server access logs showing queries with redirectClassNameForKey=_Session or similar protected class names from unexpected or unauthenticated clients; creation of new relation fields on classes by public or unauthenticated users.
• Application Behavior: Multiple user accounts showing simultaneous or geographically anomalous login activity, suggesting session token reuse; unexpected API actions performed under legitimate user session tokens from unfamiliar IP addresses.

Upgrade Parse Server to version 8.6.21 (8.x branch) or 9.5.2-alpha.8 (9.x branch) immediately, as both contain the fix that enforces proper authorization checks on queries redirected via redirectClassNameForKey (Parse Server 8.6.21 Release, Parse Server 9.5.2-alpha.8 Release). As a temporary workaround, restrict Class-Level Permissions to disable addField for public and unauthenticated users, preventing the creation of new relation fields that could be exploited. Note that this workaround does not fully eliminate risk if a relation field pointing to a protected class already exists in the schema. Additionally, audit existing session tokens and revoke any that may have been compromised (GitHub Advisory).

The vulnerability was reported by security researcher theinfosecguy and coordinated by Parse Server maintainer mtrezza, who published the advisory on March 10, 2026 (GitHub Advisory). The advisory received attention from automated CVE tracking services and vulnerability databases shortly after publication, with entries appearing on VulnDB, Bluesky CVE feeds, and ENISA's EUVD. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified.