Most recent entries from all

BIT-parse-2026-34574 — Parse Server: Session field immutability bypass via falsy-value guard

2026-10-06T05:02:09.550536+00:00

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0.

EUVD-2026-278514

2026-10-06T05:02:09.550600+00:00

EUVD-2026-278514

fkie_cve-2026-34574

2026-10-06T05:02:09.550617+00:00

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.

GHSA-f6j3-w9v3-cq22 — Parse Server has a session field immutability bypass via falsy-value guard

2026-10-06T05:02:09.550644+00:00

Affected: npm: parse-server

### Impact

An authenticated user can bypass the immutability guard on session fields (`expiresAt`, `createdWith`) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.

### Patches

The truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.

### Workarounds

There is no known workaround. A `beforeSave` trigger on `_Session` could be used to reject null values for `expiresAt` and `createdWith`.