CVE-2026-34574
published 2026-03-31CVE-2026-34574: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an…
PriorityP432medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.21%
11.4th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 8.6.69 | 8.6.69 |
| parse-community | parse-server | — | — |
| parse-community | parse-server | >= 0 < 8.6.69 | 8.6.69 |
| parse-community | parse-server | >= 9.0.0 < 9.7.0-alpha.14 | 9.7.0-alpha.14 |
| parseplatform | parse-server | < 8.6.69 | 8.6.69 |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | >= 9.0.0 < 9.7.0 | 9.7.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Parse Server has a session field immutability bypass via falsy-value guard
ghsa·2026-04-01
CVE-2026-34574 [MEDIUM] CWE-697 Parse Server has a session field immutability bypass via falsy-value guard
Parse Server has a session field immutability bypass via falsy-value guard
### Impact
An authenticated user can bypass the immutability guard on session fields (`expiresAt`, `createdWith`) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.
### Patches
The truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.
### Workarounds
There is no known workaround. A `beforeSave` trigger on `_Session` could be used to reject null values for `expiresAt` and `createdWith`.
OSV
Parse Server has a session field immutability bypass via falsy-value guard
osv·2026-04-01
CVE-2026-34574 [MEDIUM] Parse Server has a session field immutability bypass via falsy-value guard
Parse Server has a session field immutability bypass via falsy-value guard
### Impact
An authenticated user can bypass the immutability guard on session fields (`expiresAt`, `createdWith`) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.
### Patches
The truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.
### Workarounds
There is no known workaround. A `beforeSave` trigger on `_Session` could be used to reject null values for `expiresAt` and `createdWith`.
No detection rules found.
No public exploits indexed.
https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777https://github.com/parse-community/parse-server/pull/10347https://github.com/parse-community/parse-server/pull/10348https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
2026-03-31
Published