Live › vulnerability › CVE-2026-121413
Parse Server's session upgrade endpoint creates new sessions for anyone holding a valid session token, ignoring the _Session create permission. An attacker with a stolen token can obtain sessions that survive the original user logging out.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Apps running a Parse Server version below the fixed releases that expose the upgradeToRevocableSession endpoint. The attacker needs a valid session token already, so exposure depends on how widely tokens leak. Teams on managed hosting or on releases at or above the fixed versions can skip it.
No product ranges from the sources yet.
npm ls parse-server and compare it to the fixed versions below./upgradeToRevocableSession in server or proxy logs.8.6.112: upgrade to 8.6.112 or later.9.0.0 before : upgrade to or later.9.10.6-alpha.49.10.6-alpha.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.
This page as .md · .json · in your agent: get_signal("CVE-2026-121413")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.