Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-n8kv-67nw-xbaw
Vulnerability ID VCID-n8kv-67nw-xbaw
Aliases CVE-2026-34574
GHSA-f6j3-w9v3-cq22
Summary Parse Server has a session field immutability bypass via falsy-value guard ### Impact An authenticated user can bypass the immutability guard on session fields (`expiresAt`, `createdWith`) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. ### Patches The truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null. ### Workarounds There is no known workaround. A `beforeSave` trigger on `_Session` could be used to reject null values for `expiresAt` and `createdWith`.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-697 Incorrect Comparison
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2026-34574
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2026-34574
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2026-34574
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-f6j3-w9v3-cq22
cvssv4 5.3 https://github.com/parse-community/parse-server
generic_textual MODERATE https://github.com/parse-community/parse-server
cvssv4 5.3 https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21
generic_textual MODERATE https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21
ssvc Track https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21
cvssv4 5.3 https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777
generic_textual MODERATE https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777
ssvc Track https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777
cvssv4 5.3 https://github.com/parse-community/parse-server/pull/10347
generic_textual MODERATE https://github.com/parse-community/parse-server/pull/10347
ssvc Track https://github.com/parse-community/parse-server/pull/10347
cvssv4 5.3 https://github.com/parse-community/parse-server/pull/10348
generic_textual MODERATE https://github.com/parse-community/parse-server/pull/10348
ssvc Track https://github.com/parse-community/parse-server/pull/10348
cvssv3.1_qr MODERATE https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
cvssv4 5.3 https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
generic_textual MODERATE https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
ssvc Track https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
cvssv4 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-34574
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-34574
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-34574
https://github.com/parse-community/parse-server
https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21
https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777
https://github.com/parse-community/parse-server/pull/10347
https://github.com/parse-community/parse-server/pull/10348
https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
https://nvd.nist.gov/vuln/detail/CVE-2026-34574
GHSA-f6j3-w9v3-cq22 https://github.com/advisories/GHSA-f6j3-w9v3-cq22
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-01T17:57:17Z/ Found at https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-01T17:57:17Z/ Found at https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server/pull/10347
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-01T17:57:17Z/ Found at https://github.com/parse-community/parse-server/pull/10347
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server/pull/10348
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-01T17:57:17Z/ Found at https://github.com/parse-community/parse-server/pull/10348
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-01T17:57:17Z/ Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-34574
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.10713
EPSS Score 0.00035
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:51:49.218678+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-f6j3-w9v3-cq22/GHSA-f6j3-w9v3-cq22.json 38.6.0