5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34574

CVE-2026-34574: Parse Server: Session field immutability bypass via falsy-value guard

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34574

CVE-2026-34574:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.7.0-alpha.14	9.7.0-alpha.14
parse-server	npm	< 8.6.69	8.6.69

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the RestWrite.handleSession function, which is responsible for processing updates to session objects in Parse Server. The core of the issue is an improper validation check on supposedly immutable session fields, specifically expiresAt and createdWith. The original code used a simple truthiness check to determine if a user was attempting to modify these fields. However, this check is insufficient because null is a falsy value in JavaScript. An authenticated attacker could send a PUT request to the session update endpoint with "expiresAt": null. The vulnerable code would evaluate if (null) as false, bypassing the security check and allowing the expiresAt field to be set to null. This effectively removes the session's expiration, allowing it to remain valid indefinitely, thus bypassing session length policies. The provided patches fix this by replacing the flawed truthiness check with a more robust key-presence check ('key' in object), which correctly detects whether the key is present in the request body, regardless of its value. This ensures that any attempt to modify these protected fields is properly rejected.

Vulnerable functions

RestWrite.handleSession

src/RestWrite.js

The vulnerability is in the `handleSession` function of the `RestWrite` class. The function uses truthiness checks (e.g., `if (this.data.expiresAt)`) to guard against modification of immutable session fields. An authenticated user can send a request with a `null` value for fields like `expiresAt` or `createdWith`. Since `null` is a falsy value in JavaScript, the check is bypassed, allowing the user to nullify the session's expiration date, making it valid indefinitely. The patch replaces the truthiness check with a key-presence check (`'expiresAt' in this.data`) to correctly reject any modification of these fields.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.