Parse Server prior to version 8.6.98 and 9.0.0 prior to 9.10.3-alpha.1 fails to enforce the create and addField class‑level permissions for the _Session class when new sessions are created. An authenticated user, or anyone who possesses a valid session token for that user, can issue POST requests to the /sessions or /classes/_Session endpoints to generate additional sessions and modify session fields, even after the original session has been logged out. This flaw permits an attacker to create and maintain unauthorized sessions, potentially enhancing persistence and bypassing denied access controls by exploiting the absence of revocation logic.

The vulnerability affects Parse Server releases before 8.6.98 and before 9.10.3-alpha.1 in the 9.x line. Any environment running those earlier versions is impacted, regardless of deployment scale, because the flaw is present in the core session handling code provided by the parse-community project.

The CVSS score of 2.3 indicates low severity in the current assessment, yet the EPSS score is not available, so a precise exploit probability cannot be quantified. No listing appears in the CISA KEV catalog, implying no public exploitation at the time of reporting. The likely attack vector is a remote authenticated request using a valid session token, as the flaw requires the attacker to possess a token for the target user. Exploitation requires no additional credentials and can be performed from any network accessible to the Parse Server instance, making the vulnerability exploitable by anyone who can intercept or obtain a legitimate session token.