CVE-2026-33527

🗓️ 24 Mar 2026 18:22:44Reported by GitHub_MType

CVE-2026-33527 lets authenticated users overwrite session expiresAt and createdWith via REST, bypassing lifetime; fixed in 8.6.57 and 9.6.0-alpha.48.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-33527	24 Mar 202618:22	–	attackerkb
CNNVD	Parse Server 安全漏洞	24 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-33527 Parse Server: Session update endpoint allows overwriting server-generated session fields	24 Mar 202618:22	–	cvelist
EUVD	EUVD-2026-14974	24 Mar 202616:34	–	euvd
Github Security Blog	Parse Server's Session Update endpoint allows overwriting server-generated session fields	24 Mar 202616:34	–	github
NVD	CVE-2026-33527	24 Mar 202619:16	–	nvd
OSV	BIT-PARSE-2026-33527 Parse Server: Session update endpoint allows overwriting server-generated session fields	27 Mar 202607:14	–	osv
OSV	CVE-2026-33527 Parse Server: Session update endpoint allows overwriting server-generated session fields	24 Mar 202618:22	–	osv
OSV	GHSA-JC39-686J-WP6Q Parse Server's Session Update endpoint allows overwriting server-generated session fields	24 Mar 202616:34	–	osv
Positive Technologies	PT-2026-27482	24 Mar 202600:00	–	ptsecurity

NVD

Vulners

Node

parseplatform parse-serverRange<8.6.57node.js

parseplatform parse-serverRange9.0.0–9.6.0node.js

parseplatform parse-serverMatch9.6.0alpha1node.js

parseplatform parse-serverMatch9.6.0alpha10node.js

parseplatform parse-serverMatch9.6.0alpha11node.js

parseplatform parse-serverMatch9.6.0alpha12node.js

parseplatform parse-serverMatch9.6.0alpha13node.js

parseplatform parse-serverMatch9.6.0alpha14node.js

parseplatform parse-serverMatch9.6.0alpha15node.js

parseplatform parse-serverMatch9.6.0alpha16node.js

parseplatform parse-serverMatch9.6.0alpha17node.js

parseplatform parse-serverMatch9.6.0alpha18node.js

parseplatform parse-serverMatch9.6.0alpha19node.js

parseplatform parse-serverMatch9.6.0alpha2node.js

parseplatform parse-serverMatch9.6.0alpha20node.js

parseplatform parse-serverMatch9.6.0alpha21node.js

parseplatform parse-serverMatch9.6.0alpha22node.js

parseplatform parse-serverMatch9.6.0alpha23node.js

parseplatform parse-serverMatch9.6.0alpha24node.js

parseplatform parse-serverMatch9.6.0alpha25node.js

parseplatform parse-serverMatch9.6.0alpha26node.js

parseplatform parse-serverMatch9.6.0alpha27node.js

parseplatform parse-serverMatch9.6.0alpha28node.js

parseplatform parse-serverMatch9.6.0alpha29node.js

parseplatform parse-serverMatch9.6.0alpha3node.js

parseplatform parse-serverMatch9.6.0alpha30node.js

parseplatform parse-serverMatch9.6.0alpha31node.js

parseplatform parse-serverMatch9.6.0alpha32node.js

parseplatform parse-serverMatch9.6.0alpha33node.js

parseplatform parse-serverMatch9.6.0alpha34node.js

parseplatform parse-serverMatch9.6.0alpha35node.js

parseplatform parse-serverMatch9.6.0alpha36node.js

parseplatform parse-serverMatch9.6.0alpha37node.js

parseplatform parse-serverMatch9.6.0alpha38node.js

parseplatform parse-serverMatch9.6.0alpha39node.js

parseplatform parse-serverMatch9.6.0alpha4node.js

parseplatform parse-serverMatch9.6.0alpha40node.js

parseplatform parse-serverMatch9.6.0alpha41node.js

parseplatform parse-serverMatch9.6.0alpha42node.js

parseplatform parse-serverMatch9.6.0alpha43node.js

parseplatform parse-serverMatch9.6.0alpha44node.js

parseplatform parse-serverMatch9.6.0alpha45node.js

parseplatform parse-serverMatch9.6.0alpha46node.js

parseplatform parse-serverMatch9.6.0alpha47node.js

parseplatform parse-serverMatch9.6.0alpha5node.js

parseplatform parse-serverMatch9.6.0alpha6node.js

parseplatform parse-serverMatch9.6.0alpha7node.js

parseplatform parse-serverMatch9.6.0alpha8node.js

parseplatform parse-serverMatch9.6.0alpha9node.js

[
  {
    "vendor": "parse-community",
    "product": "parse-server",
    "versions": [
      {
        "version": "< 8.6.57",
        "status": "affected"
      },
      {
        "version": ">= 9.0.0, < 9.6.0-alpha.48",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/parse-community/parse-server/pull/10263
github	www.github.com/parse-community/parse-server/commit/26b628c8fb3cc79ea955374769eebcff6f8a8a73
github	www.github.com/parse-community/parse-server/pull/10264
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-jc39-686j-wp6q
github	www.github.com/parse-community/parse-server/commit/ea68fc0b22a6056c9675149469ff57817f7cf984

25 Mar 2026 21:19Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.14.3

CVSS 45.3

EPSS0.00014

SSVC

CWE-863