CVE-2026-34574: Parse Server: Session field immutability bypass via falsy-value guard
Impact
An authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.
Patches
The truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.
Workarounds
There is no known workaround. A beforeSave trigger on Session could be used to reject null values for expiresAt and createdWith.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 8.6.69 - Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 9.7.0-alpha.14 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 8.6.69 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 9.7.0-alpha.14