Executive brief
Parse Server is an open-source backend framework that handles user authentication and account management. An attacker can exploit the email verification endpoint to discover which email addresses are registered in the system by observing different error responses, allowing them to build a list of valid user accounts. This information disclosure weakens security by enabling targeted attacks against known users.
Technical details
The vulnerability is a user enumeration flaw (CWE-204) in the /verificationEmailRequest endpoint. When email verification is enabled (verifyUserEmails: true), the endpoint returns distinct error responses based on whether an email belongs to an existing user, is already verified, or does not exist. An unauthenticated attacker can send requests to this network-accessible endpoint with arbitrary email addresses and infer user registration status from the response codes. The fix introduces an emailVerifySuccessOnInvalidEmail option (default: true) that returns a generic success response for all requests, preventing enumeration. Patches are available in Parse Server 8.6.34 and 9.6.0-alpha.8.
Affected products
- Parse Community Parse Server 0 to 8.6.33; 9.0.0-alpha.1 to 9.6.0-alpha.7
Timeline
- 2026-03-11: disclosed
- 2026-03-11: patched: Parse Server 8.6.34 and 9.6.0-alpha.8