CVE-2026-33527

moderate-risk
Published 2026-03-24

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent. This issue has been patched in versions 8.6.57 and 9.6.0-alpha.48.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Parseplatform

References (5)

Patch https://github.com/parse-community/parse-server/commit/26b628c8fb3cc79ea95537476...
Patch https://github.com/parse-community/parse-server/commit/ea68fc0b22a6056c967514946...
Issue Tracking https://github.com/parse-community/parse-server/pull/10263
Issue Tracking https://github.com/parse-community/parse-server/pull/10264
Vendor Advisory https://github.com/parse-community/parse-server/security/advisories/GHSA-jc39-68...
43
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 25/34 · High