CVE-2026-30965 Scanner
CVE-2026-30965 Scanner - Information Disclosure vulnerability in Parse Server
Used 3.1k times · 5.9k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-30965
9.9
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other users by exploiting the redirectClassNameForKey query parameter. Exfiltrated session tokens can be used to take over user accounts. The vulnerability requires the attacker to be able to create or update an object with a new relation field, which depends on the Class-Level Permissions of at least one class. This vulnerability is fixed in 9.5.2-alpha.8 and 8.6.21.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
parse-server
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: parse-server
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →