← Database

CVE-2026-33527

MEDIUM CVSS: 4.3 Published: 2026-03-24 Modified: 2026-06-17

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent. This issue has been patched in versions 8.6.57 and 9.6.0-alpha.48.

Affected Platforms

Parseplatform Parse-Server

Weakness Type

CWE-863

References