GHSA-w54v-hf9p-8856

Source

https://github.com/advisories/GHSA-w54v-hf9p-8856

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-w54v-hf9p-8856/GHSA-w54v-hf9p-8856.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w54v-hf9p-8856

Aliases

Published

2026-03-11T00:36:13Z

Modified

2026-03-13T13:11:05.860158Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Parse Server vulnerable to user enumeration via email verification endpoint

Details

Impact

The email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to an existing user, is already verified, or does not exist. An attacker can send requests with different email addresses and observe the error codes to determine which email addresses are registered in the application.

This is a user enumeration vulnerability that affects any Parse Server deployment with email verification enabled (verifyUserEmails: true).

Patches

The fix introduces a new Parse Server option emailVerifySuccessOnInvalidEmail (default: true) that returns a generic success response for all verification email requests, regardless of whether the email address is valid, already verified, or non-existent. This prevents an attacker from distinguishing between these cases.

The fix also strengthens the input validation for the related resetPasswordSuccessOnInvalidEmail option, and adds security checks that warn when either enumeration mitigation is disabled.

Workarounds

There is no known workaround.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856
Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.8
Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.34

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-11T00:36:13Z",
    "severity": "MODERATE",
    "nvd_published_at": "2026-03-11T20:16:16Z",
    "cwe_ids": [
        "CWE-204"
    ]
}

References

Affected packages

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

9.0.0-alpha.1

Fixed

9.6.0-alpha.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-w54v-hf9p-8856/GHSA-w54v-hf9p-8856.json"

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.6.34

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-w54v-hf9p-8856/GHSA-w54v-hf9p-8856.json"