{"id":"CVE-2026-34574","aliases":["BIT-parse-2026-34574","EUVD-2026-17502","GHSA-f6j3-w9v3-cq22"],"status":"published","title":"Parse Server: Session field immutability bypass via falsy-value guard","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00218,"percentile":0.12319,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-697"],"published":"2026-03-31T15:08:31Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"npm","package":"parse-server","fixed_in":["9.7.0-alpha.14","8.6.69"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"parse","fixed_in":["8.6.69","9.7.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.7.0-alpha.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.69"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"parse","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.6.69"},{"introduced":"9.0.0"},{"fixed":"9.7.0"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.7.0-alpha.14"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.6.69"}]}]}],"products":[{"vendor":"parse-community","product":"parse-server"},{"vendor":"parseplatform","product":"parse-server"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/parse-community/parse-server/pull/10347","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/parse-community/parse-server/pull/10348","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34574","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-f6j3-w9v3-cq22"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34574.json","tags":["advisory"]},{"url":"https://github.com/parse-community/parse-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34574","title":"Parse Server: Session field immutability bypass via falsy-value guard","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.","status":"published","published":"2026-03-31T15:08:31.013Z","modified":"2026-04-01T17:57:27.398Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-17502","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.","status":"published","published":"2026-03-31T15:08:31Z","modified":"2026-04-01T17:57:27Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:24.09733Z"}],"ghsa":[{"id":"GHSA-f6j3-w9v3-cq22","title":"Parse Server has a session field immutability bypass via falsy-value guard","description":"### Impact\n\nAn authenticated user can bypass the immutability guard on session fields (`expiresAt`, `createdWith`) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.\n\n### Patches\n\nThe truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.\n\n### Workarounds\n\nThere is no known workaround. A `beforeSave` trigger on `_Session` could be used to reject null values for `expiresAt` and `createdWith`.","status":"published","published":"2026-04-01T00:03:19Z","modified":"2026-04-01T00:03:20Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:39:47.075804Z"}],"nvd":[{"id":"CVE-2026-34574","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.","status":"published","published":"2026-03-31T16:16:33.923Z","modified":"2026-07-24T20:10:00.147Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"CVE-2026-34574","title":"Parse Server: Session field immutability bypass via falsy-value guard","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.","status":"published","published":"2026-03-31T15:08:31.013Z","modified":"2026-10-28T02:30:54.254276439Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-f6j3-w9v3-cq22","title":"Parse Server has a session field immutability bypass via falsy-value guard","description":"### Impact\n\nAn authenticated user can bypass the immutability guard on session fields (`expiresAt`, `createdWith`) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.\n\n### Patches\n\nThe truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.\n\n### Workarounds\n\nThere is no known workaround. A `beforeSave` trigger on `_Session` could be used to reject null values for `expiresAt` and `createdWith`.","status":"published","published":"2026-04-01T00:03:19Z","modified":"2026-04-06T15:27:15.966361294Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"BIT-parse-2026-34574","title":"Parse Server: Session field immutability bypass via falsy-value guard","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0.","status":"published","published":"2026-04-06T14:49:34.81Z","modified":"2026-09-08T08:48:17.793118704Z","updated_at":"2026-11-02T15:28:34.343258Z"}]}}