Listen to this Post
The vulnerability arises from a truthiness‑based guard in Parse Server’s session update endpoint. When an authenticated user sends a PUT request to `/sessions/{ "createdWith": null }, the server checks whether the incoming field is “truthy” to decide if it should be immutable. Because `null` is falsy, the guard is bypassed, allowing the user to nullify the `expiresAt` field. This makes the session never expire, effectively overriding any configured session length policies. The same applies to the `createdWith` field. The patch replaces the truthiness check with a key‑presence check: if the field appears in the request at all (regardless of its value), the update is rejected. The issue affects all versions from 9.0.0 up to the first patched alpha (9.7.0‑alpha.14) and versions below 8.6.69. No workaround exists besides a `beforeSave` trigger that manually rejects `null` values.
dailycve form:
Platform: Parse Server
Version: 9.0.0–9.7.0-alpha.13,
<8.6.69
Vulnerability : Session immutability bypass
Severity: Moderate
date: Mar 31, 2026
Prediction: Already patched (Apr 1, 2026)
What Undercode Say:
Verify affected version
npm list parse-server
Simulate exploit (requires valid session token)
curl -X PUT \
-H "X-Parse-Session-Token: r:valid_token" \
-H "Content-Type: application/json" \
-d '{"expiresAt": null}' \
https://your-parse-server.com/parse/sessions/current
How Exploit:
- Authenticate to obtain a session token.
- Send a PUT request to `/sessions/current` with
{"expiresAt": null}. - The server nullifies the expiry, turning the session into a non‑expiring token.
Protection from this CVE:
- Upgrade to `[email protected]` or
9.7.0-alpha.14+. - If upgrade impossible, add a `beforeSave` trigger for `_Session` that rejects `null` values for `expiresAt` and
createdWith.
Impact:
- Bypass of session expiration policies.
- Persistent, never‑expiring sessions for authenticated users.
- Increased risk of session hijacking and long‑term unauthorized access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
