Executive brief
Parse Server is a backend framework that manages user sessions and authentication for applications. An authenticated user can manipulate session fields to bypass session expiration policies, potentially making their login credentials valid indefinitely. This undermines the organization's ability to enforce session timeout requirements and increases the risk of unauthorized access if credentials are compromised.
Technical details
The vulnerability exists in Parse Server's Session Update REST API endpoint, which fails to restrict authenticated users from modifying server-generated session fields such as expiresAt and createdWith. An authenticated attacker with valid session credentials can make API requests to update their own session, overwriting these protected fields to extend or remove the session expiration time. This is classified as an improper authorization issue (CWE-863). The attack requires valid authentication credentials but no additional user interaction. Patches are available in Parse Server 9.6.0-alpha.48 and 8.6.57, which implement field-level restrictions preventing authenticated users from setting these protected fields while preserving master key and maintenance key operations.
Affected products
- Parse Community Parse Server 0 through 8.6.56, 9.0.0 through 9.6.0-alpha.47
Timeline
- 2026-03-24: disclosed: Advisory published
- 2026-03-24: patched: Fix released in Parse Server 9.6.0-alpha.48 and 8.6.57