Em resumo
- CVE-2026-33527 é uma vulnerabilidade MÉDIO (CVSS 4.3) que afeta parse-server (parseplatform), parse-server.
- Chance de exploração nos próximos 30 dias (EPSS): 0.27%, maior que 18.5% das vulnerabilidades.
- Correção: atualize para 9.6.0, 8.6.57, 9.6.0-alpha.48 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.57
| 9.6.08.6.57
|
| parse-server npm | ≥ 9.0.0, < 9.6.0-alpha.48< 8.6.57
| 9.6.0-alpha.488.6.57
|
Description
Impact
An authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent.
Patches
The fix blocks authenticated users from setting expiresAt and createdWith fields when updating a session. Master key and maintenance key operations are not affected.
Workarounds
There is no known workaround other than upgrading.
Resources
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent. This issue has been patched in versions 8.6.57 and 9.6.0-alpha.48.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free