CVE-2026-34574: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34574 is a session field immutability bypass vulnerability in Parse Server, an open-source Node.js backend platform. An authenticated user can bypass the immutability guard on protected session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint, effectively nullifying session expiry and making sessions valid indefinitely. The vulnerability affects all Parse Server versions prior to 8.6.69 (8.x branch) and versions 9.0.0 through 9.7.0-alpha.13 (9.x branch). It was disclosed on March 31, 2026, with patches released on March 29, 2026. The CVSS v3.1 base score is 5.4 (Medium) and the CVSS v4.0 base score is 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is an incorrect comparison (CWE-697) in RestWrite.prototype.handleSession within src/RestWrite.js. The original guard used truthiness checks (e.g., if (this.data.expiresAt && ...)) to block modification of immutable session fields, which evaluates to false when the value is null — a falsy value in JavaScript — allowing the null to pass through undetected. The fix replaced these with key-presence checks ('expiresAt' in this.data) that reject any value for protected fields regardless of truthiness. Exploitation requires only an authenticated session (low privileges) and a crafted HTTP PUT request to /sessions/:objectId with a JSON body containing {"expiresAt": null} or {"createdWith": null} (GitHub Advisory, Fix PR #10347).

Successful exploitation allows an authenticated attacker to nullify the expiresAt field of their own session, causing it to remain valid indefinitely and bypassing any configured session length or expiry policies. This results in low confidentiality and integrity impacts — the attacker maintains persistent unauthorized access to their account without re-authentication, even after the intended session lifetime has elapsed. There is no availability impact, and the vulnerability does not directly enable lateral movement or privilege escalation beyond persistent session persistence (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.045% (0.000450), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Authenticate: Obtain a valid session token by logging into a Parse Server instance running a vulnerable version (< 8.6.69 or 9.0.0–9.7.0-alpha.13) using any standard user account.
2. Retrieve session ID: Send a GET request to /1/sessions/me with the X-Parse-Session-Token header to retrieve the current session's objectId and confirm the current expiresAt value.
3. Send malicious PUT request: Issue a PUT request to /1/sessions/:objectId with the session token in the header and a JSON body of {"expiresAt": null}. Because the original guard used a truthiness check, null bypasses the immutability protection.
4. Verify bypass: Confirm the session's expiresAt field has been nullified by re-querying /1/sessions/me. The session will now remain valid indefinitely, bypassing configured session length policies.
5. Maintain persistent access: Use the now-non-expiring session token for continued access to the application without re-authentication, even after the original expiry time has passed (GitHub Advisory, Fix Commit).

• Network: Unusual HTTP PUT requests to /1/sessions/<objectId> endpoints containing a JSON body with null values for expiresAt, createdWith, installationId, or sessionToken fields.
• Logs: Parse Server access logs showing PUT requests to /sessions/ endpoints from authenticated users with Content-Type: application/json and null-valued protected fields; absence of expected session expiry errors for such requests on unpatched versions.
• Application State: Sessions in the Parse Server _Session collection with a null or missing expiresAt field that were not created by a master/maintenance key; sessions that remain active well beyond the configured session length policy.

Upgrade Parse Server to version 8.6.69 (8.x LTS branch) or 9.7.0-alpha.14 / 9.7.0 (9.x branch) or later, which replace the falsy-value guard with key-presence checks in RestWrite.js (Fix PR #10347, Fix PR #10348). If immediate patching is not possible, implement a beforeSave Cloud Code trigger on the _Session class to reject PUT requests containing null values for expiresAt and createdWith. Additionally, audit existing sessions in the _Session collection for records with null expiresAt values and revoke any suspicious sessions (GitHub Advisory).