PT-2026-29278 · Parse Community · Parse Server

Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-34574

Mitre

CVSS v4.0

5.3

Medium

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2026-34574

Affected Products

Parse Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34574 · Security Note
• https://github.com/parse-community/parse-server/pull/10348 · Note
• https://github.com/parse-community/parse-server/pull/10347 · Note
• https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777 · Note
• https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22 · Note