{"cve":"CVE-2026-30965","nvd":{"published":"2026-03-10T21:16:48.820","modified":"2026-06-17T10:33:14.297","status":"Analyzed","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other users by exploiting the redirectClassNameForKey query parameter. Exfiltrated session tokens can be used to take over user accounts. The vulnerability requires the attacker to be able to create or update an object with a new relation field, which depends on the Class-Level Permissions of at least one class. This vulnerability is fixed in 9.5.2-alpha.8 and 8.6.21.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","score":9.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1},"cwes":["CWE-863"],"references":["https://github.com/parse-community/parse-server/releases/tag/8.6.21","https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.8","https://github.com/parse-community/parse-server/security/advisories/GHSA-6r2j-cxgf-495f"],"products":["parseplatform:parse-server"],"source":"nvd","synced_at":"2026-10-19T22:25:53.701907451+00:00"},"epss":{"cve":"CVE-2026-30965","score":0.01358,"percentile":0.7169,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-6r2j-cxgf-495f","url":"https://osv.dev/vulnerability/GHSA-6r2j-cxgf-495f","summary":"Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter","modified":"2026-03-14T03:41:04.557395Z","packages":[{"ecosystem":"npm","name":"parse-server","purl":"pkg:npm/parse-server","ranges":[">=9.0.0-alpha.1 <9.5.2-alpha.8"],"fixed":["9.5.2-alpha.8"]},{"ecosystem":"npm","name":"parse-server","purl":"pkg:npm/parse-server","ranges":["<8.6.21"],"fixed":["8.6.21"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}