CVE-2026-34574: Parse Server has a session field immutability bypass via falsy-value guard
An authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.
References
- github.com/advisories/GHSA-f6j3-w9v3-cq22
- github.com/parse-community/parse-server
- github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21
- github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777
- github.com/parse-community/parse-server/pull/10347
- github.com/parse-community/parse-server/pull/10348
- github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
- nvd.nist.gov/vuln/detail/CVE-2026-34574
Code Behaviors & Features
Detect and mitigate CVE-2026-34574 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →