Parse Server’s query handling allows an attacker, whether authenticated or not, to obtain the session tokens of any user by passing a specially crafted value for the redirectClassNameForKey query parameter. The attacker can then hijack the victim’s account because the stolen tokens grant full access to that user’s resources.

The vulnerability affects the open‑source Parse Server from the parse-community project. Versions prior to 9.5.2‑alpha.8 and 8.6.21 are impacted; all later releases contain a patch that removes the flaw.

The high severity score reflects the potential for full account takeover if successful. Exploitation requires the attacker to write or modify an object that contains a new relation field, which depends on the Class‑Level Permissions of at least one class. The exploitation likelihood is low, estimated at less than one percent, and the vulnerability is not currently part of the CISA KEV catalogue.