CVE-2026-30965 - Vulnerability Analysis

Overview

Parse Server < 9.5.2-alpha.8 and < 8.6.21 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a new relation field depending on Class-Level Permissions.

Severity & Score

Impact

Attackers can exfiltrate session tokens and take over user accounts, leading to account compromise.

Mitigation

Update to version 9.5.2-alpha.8 or 8.6.21 or later.

References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-6r2j-cxgf-495f
• https://github.com/parse-community/parse-server/releases/tag/8.6.21
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.8

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner