CVE-2026-33527: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33527 is an Incorrect Authorization vulnerability in Parse Server (an open-source Node.js backend) that allows an authenticated user to overwrite server-generated session fields — specifically expiresAt and createdWith — via the REST API session update (PUT) endpoint. This effectively enables bypassing the server's configured session lifetime policy, making a session permanently valid. The vulnerability affects all Parse Server versions prior to 8.6.57 (8.x branch) and versions 9.0.0 through 9.6.0-alpha.47 (9.x branch). It was disclosed on March 21, 2026, with patches released the same day. The CVSS v3.1 base score is 4.3 (Medium) and the CVSS v4.0 base score is 5.3 (Medium) (GitHub Advisory).

The root cause is CWE-863 (Incorrect Authorization): the RestWrite.prototype.handleSession function in src/RestWrite.js blocked modification of certain server-generated session fields (e.g., user, installationId, sessionToken) during session creation, but failed to apply the same restrictions to the session update (PUT) path. This was an incomplete fix of a prior related advisory (GHSA-5v7g-9h8f-8pgg). An authenticated attacker with a valid session token can send a crafted HTTP PUT request to /sessions/<sessionId> including expiresAt or createdWith fields in the JSON body, and the server will accept and persist those values without authorization checks. The fix adds explicit guards in handleSession that throw INVALID_KEY_NAME if expiresAt or createdWith are present in the update payload and the requester is not using a master key or maintenance key (GitHub Advisory, Fix PR #10264).

A successfully exploited vulnerability allows an authenticated attacker to extend or eliminate their session's expiration by setting expiresAt to an arbitrarily far future date (e.g., year 2099), effectively making the session permanent and bypassing time-based access controls. This enables persistent unauthorized access to a compromised account even after the intended session lifetime has elapsed, preventing legitimate session timeout mechanisms from functioning. There is no direct confidentiality or availability impact, but the integrity of session lifecycle management is undermined, and an attacker could maintain indefinite persistence in a compromised account (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session, limiting the attack surface to users who already have account access (GitHub Advisory, Feedly).

1. Authenticate: Obtain a valid session token for a Parse Server account (e.g., via normal login or a free/trial account registration).
2. Retrieve session ID: Send a GET request to /1/sessions/me with the X-Parse-Session-Token header to retrieve the current session's objectId and current expiresAt value.
3. Craft malicious PUT request: Send an HTTP PUT request to /1/sessions/<sessionId> with the session token in the X-Parse-Session-Token header and a JSON body containing a far-future expiresAt value, e.g.:

{
  "expiresAt": { "__type": "Date", "iso": "2099-12-31T23:59:59.000Z" }
}

4. Verify persistence: Confirm the session's expiresAt has been updated by re-querying /1/sessions/me. The session will now remain valid indefinitely, bypassing the server's configured session lifetime policy.
5. Maintain access: Use the now-permanent session token for continued unauthorized access even after the original session should have expired (Fix PR #10264, GitHub Advisory).

• Network: Unexpected HTTP PUT requests to /1/sessions/<sessionId> endpoints from authenticated users, particularly with JSON bodies containing expiresAt or createdWith fields set to far-future dates.
• Logs: Parse Server access logs showing PUT requests to session endpoints with expiresAt values far in the future (e.g., year 2099) or unusual createdWith metadata values; repeated session queries (GET /1/sessions/me) followed immediately by session update requests.
• Database: Session records in the Parse Server database (_Session collection/table) with expiresAt values significantly beyond the server's configured session duration, or createdWith fields containing unexpected or attacker-controlled values.
• Behavioral: User accounts with sessions that remain active well beyond the expected session lifetime configured on the server.

Upgrade Parse Server to version 8.6.57 (for the 8.x LTS branch) or 9.6.0-alpha.48 or later (for the 9.x branch); the stable 9.6.0 release also includes the fix. There is no known configuration-based workaround — upgrading is the only remediation. After upgrading, administrators should audit existing sessions in the _Session collection for records with anomalously far-future expiresAt values and revoke any suspicious sessions. Additionally, implement monitoring on the session update API endpoint to detect unauthorized modification attempts (GitHub Advisory, Fix PR #10263, Fix PR #10264).