What is GHSA-5v7g-9h8f-8pgg?

GHSA-5v7g-9h8f-8pgg is a security advisory published by GitHub Security Advisories with Medium severity. Parse Server session creation endpoint allows overwriting server-generated session fields

Which CVE IDs does GHSA-5v7g-9h8f-8pgg cover?

GHSA-5v7g-9h8f-8pgg covers the following CVE IDs: CVE-2026-32742. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5v7g-9h8f-8pgg?

GHSA-5v7g-9h8f-8pgg has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-5v7g-9h8f-8pgg?

GHSA-5v7g-9h8f-8pgg affects 2 products, including: npm/parse-server:\u003e= 9.0.0, \u003c 9.6.0-alpha.17; npm/parse-server:\u003c 8.6.42.

GHSA-5v7g-9h8f-8pggMediumCVSS 4.3

Parse Server session creation endpoint allows overwriting server-generated session fields

Vendor

GitHub Security Advisories

Published

March 17, 2026

Last Modified

March 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-32742 →

📋 Description

Impact

An authenticated user can overwrite server-generated session fields (sessionToken, expiresAt, createdWith) when creating a session object via POST /classes/_Session. This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictable session token value.

Patches

The session creation endpoint now filters out server-generated fields from user-supplied data, preventing them from being overwritten.

Workarounds

Add a beforeSave trigger on the _Session class to validate and reject or strip any user-supplied values for sessionToken, expiresAt, and createdWith.

🎯 Affected products2

npm/parse-server:>= 9.0.0, < 9.6.0-alpha.17
npm/parse-server:< 8.6.42