Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent. This issue has been patched in versions 8.6.57 and 9.6.0-alpha.48.

INFO

Published Date :

2026-03-24T18:22:44.613Z

Last Modified :

2026-03-24T18:22:44.613Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-33527 vulnerability.

No data.

REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-33527.

URL Resource
https://github.com/parse-community/parse-server/commit/26b628c8fb3cc79ea955374769eebcff6f8a8a73 cve-icon cve-icon
https://github.com/parse-community/parse-server/commit/ea68fc0b22a6056c9675149469ff57817f7cf984 cve-icon cve-icon
https://github.com/parse-community/parse-server/pull/10263 cve-icon cve-icon
https://github.com/parse-community/parse-server/pull/10264 cve-icon cve-icon
https://github.com/parse-community/parse-server/security/advisories/GHSA-jc39-686j-wp6q cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability