The vulnerability permits an authenticated user to ignore the immutability guard on session fields by sending a null value in a PUT request to the session update endpoint. This nullifies the expiresAt and createdWith fields, effectively removing the session timeout and allowing the session to remain valid indefinitely. The weakness is a logical comparison error that bypasses expected safeguards and can result in prolonged unauthorized access.

The flaw affects the open‑source Parse Server from parse-community. Any deployment running a version earlier than 8.6.69 or 9.7.0‑alpha.14 is vulnerable. The product is the Parse Server backend that can run on any Node.js‑capable infrastructure.

The CVSS base score of 5.3 reflects a medium severity. No EPSS score is currently reported and the vulnerability is not listed in the CISA KEV catalog, indicating a lower likelihood of widespread exploitation. However, the attack requires an authenticated user with permission to update session data, which is common in many applications. Because the vulnerability allows an attacker to keep a session alive indefinitely, it can facilitate sustained, undetected abuse and data exfiltration for as long as the session remains active.