CVE-2026-121413

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.112 Parse Server versions 9.0.0 through 9.10.6-alpha.3

Description An authorization bypass exists in the session upgrade endpoint. The system creates a new session for any valid session token without enforcing the Session class create class-level permission. An attacker possessing a user's session token can send a revocable token to the '/upgradeToRevocableSession' endpoint to obtain additional sessions with fresh expiration dates. These sessions remain active even after the original session has been logged out.

Recommendations Update Parse Server to version 8.6.112 or later. Update Parse Server to version 9.10.6-alpha.4 or later.