An authenticated user can send a session update request to Parse Server and overwrite server‑generated fields such as expiresAt and createdWith. The vulnerability enables the session to persist beyond the configured expiry period, effectively making the session permanent. This flaw falls under CWE‑863, where variables that should be protected are exposed to modification. The consequences include unauthorized persistence of access and potential escalation of privileges if the session is used to access privileged resources over an extended time.

The issue affects parse-community's Parse Server before version 8.6.57 and prior to 9.6.0‑alpha.48. Systems running those releases on any Node.js‑enabled infrastructure are vulnerable. The patch is required to eliminate the ability to change these critical session fields via the REST API.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is below 1%, showing a low likelihood of widespread exploitation at present. The vulnerability is limited to authenticated users interacting with the session update endpoint; no public or remote code execution vector is disclosed. While the impact of a permanent session is significant for the user’s own account, the overall risk remains moderate due to the requirement for valid credentials and lack of known public exploits. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not actively targeted by known threat actors.