CVE-2026-34574: parseplatform parse-server

csirt@kutim:~/threat-intel/cve/CVE-2026-34574

CVSS 5.4 · Medium EPSS 0,34%

Kerentanan Incorrect Comparison pada parseplatform parse-server. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies. This issue has been patched in versions 8.6.69 and 9.7.0-alpha.14.

Rincian

Terbit di NVD: 31 Maret 2026
Terakhir diubah: 24 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-697: Incorrect Comparison
EPSS (30 hari): 0,34% peluang dieksploitasi; lebih tinggi dari 25,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
parseplatform	parse-server	Semua versi sebelum 8.6.69
parseplatform	parse-server	Versi 9.0.0 hingga sebelum 9.7.0
parseplatform	parse-server	Versi 9.7.0 alpha1
parseplatform	parse-server	Versi 9.7.0 alpha10
parseplatform	parse-server	Versi 9.7.0 alpha11
parseplatform	parse-server	Versi 9.7.0 alpha12
parseplatform	parse-server	Versi 9.7.0 alpha13
parseplatform	parse-server	Versi 9.7.0 alpha2
parseplatform	parse-server	Versi 9.7.0 alpha3
parseplatform	parse-server	Versi 9.7.0 alpha4
parseplatform	parse-server	Versi 9.7.0 alpha5
parseplatform	parse-server	Versi 9.7.0 alpha6
parseplatform	parse-server	Versi 9.7.0 alpha7
parseplatform	parse-server	Versi 9.7.0 alpha8
parseplatform	parse-server	Versi 9.7.0 alpha9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22 patch · advisory vendor
https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21 patch
https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777 patch
https://github.com/parse-community/parse-server/pull/10347 issue tracking · patch
https://github.com/parse-community/parse-server/pull/10348 issue tracking · patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.