Parse Server has a session field immutability bypass via falsy-value guard

TRUNG BÌNH 5.4CVE-2026-34574 · BIT-parse-2026-34574 · GHSA-f6j3-w9v3-cq22 · Công bố 31/03/2026 · cập nhật 24/07/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
parse-server parseplatform	`= 9.7.0≥ 9.0.0, < 9.7.0< 8.6.69`	`9.7.08.6.69`
parse-server npm	`≥ 9.0.0, < 9.7.0-alpha.14< 8.6.69`	`9.7.0-alpha.148.6.69`

Mô tả

Impact

An authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.

Patches

The truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.

Workarounds

There is no known workaround. A beforeSave trigger on _Session could be used to reject null values for expiresAt and createdWith.

Mô tả của NVD

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.