https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T22:44:33.063334+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-parse-2026-33527 BIT-parse-2026-33527 — Parse Server: Session update endpoint allows overwriting server-generated session fields 2026-10-15T22:44:33.065901+00:00

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent. This issue has been patched in versions 8.6.57 and 9.6.0

 https://cve.radiocsirt.org/vuln/euvd-2026-277294 EUVD-2026-277294 2026-10-15T22:44:33.065948+00:00 EUVD-2026-277294 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33527 fkie_cve-2026-33527 2026-10-15T22:44:33.065964+00:00

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent. This issue has been patched in versions 8.6.57 and 9.6.0-alpha.48.

 https://cve.radiocsirt.org/vuln/ghsa-jc39-686j-wp6q GHSA-jc39-686j-wp6q — Parse Server's Session Update endpoint allows overwriting server-generated session fields 2026-10-15T22:44:33.065996+00:00

Affected: npm: parse-server

### Impact

An authenticated user can overwrite server-generated session fields such as `expiresAt` and `createdWith` when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent.

### Patches

The fix blocks authenticated users from setting `expiresAt` and `createdWith` fields when updating a session. Master key and maintenance key operations are not affected.

### Workarounds

There is no known workaround other than upgrading.

### Resources

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-jc39-686j-wp6q - Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10263 - Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10264