Parse Server has a session field immutability bypass via falsy-value guard

🗓️ 01 Apr 2026 00:03:19Reported by GitHub Advisory DatabaseType

Authenticated user can bypass session immutability by sending null in put request to expiresAt or createdWith; guards now use key presence checks.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-34574	31 Mar 202615:08	–	attackerkb
CNNVD	Parse Server 安全漏洞	31 Mar 202600:00	–	cnnvd
CVE	CVE-2026-34574	31 Mar 202615:08	–	cve
Cvelist	CVE-2026-34574 Parse Server: Session field immutability bypass via falsy-value guard	31 Mar 202615:08	–	cvelist
EUVD	EUVD-2026-17502	1 Apr 202600:03	–	euvd
NVD	CVE-2026-34574	31 Mar 202616:16	–	nvd
OSV	BIT-PARSE-2026-34574 Parse Server: Session field immutability bypass via falsy-value guard	6 Apr 202614:49	–	osv
OSV	CVE-2026-34574 Parse Server: Session field immutability bypass via falsy-value guard	31 Mar 202615:08	–	osv
OSV	GHSA-F6J3-W9V3-CQ22 Parse Server has a session field immutability bypass via falsy-value guard	1 Apr 202600:03	–	osv
Positive Technologies	PT-2026-29278	31 Mar 202600:00	–	ptsecurity

Vulners

Node

parseplatform parse-serverRange9.0.0–9.7.0-alpha.14npm

Source	Link
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-34574
github	www.github.com/parse-community/parse-server/pull/10347
github	www.github.com/parse-community/parse-server/pull/10348
github	www.github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21
github	www.github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777
github	www.github.com/advisories/GHSA-f6j3-w9v3-cq22

01 Apr 2026 00:03Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.4

CVSS 45.3

EPSS0.00035

SSVC