Parse Server allows an authenticated user to send a PUT request to the session update endpoint with a null value, bypassing the immutability guard on session fields such as expiresAt and createdWith. This flaw, identified as a conditional logic error (CWE‑697), allows the session to never expire, effectively granting the attacker an indefinitely valid session. The impact is the potential for continued unauthorized access and privilege persistence within the application.

The affected vendor is parse-community for the Parse Server product. Prior to version 8.6.69 and 9.7.0‑alpha.14, all releases of Parse Server are vulnerable, including the numerous alpha releases listed in the CPE entries: 9.7.0‑alpha.1 through 9.7.0‑alpha.13 as well as the default asterisk wildcard for any version of parse-server running on Node.js.

The CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score of less than 1% means the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw remotely by authenticating and performing a controlled PUT request to the session update endpoint, which is the most direct attack vector. Due to the low exploitation probability and lack of public exploits, the threat is primarily a potential for long‑term unauthorized persistence rather than an immediate widespread attack.