Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuard View on GitHub

GHSA-w54v-hf9p-8856

MediumCVSS 6.3 / 10

Published Mar 11, 2026·Last modified Mar 13, 2026

Affected Components(0)

No affected components available

Description

Impact

The email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to an existing user, is already verified, or does not exist. An attacker can send requests with different email addresses and observe the error codes to determine which email addresses are registered in the application.

This is a user enumeration vulnerability that affects any Parse Server deployment with email verification enabled (verifyUserEmails: true).

Patches

The fix introduces a new Parse Server option emailVerifySuccessOnInvalidEmail (default: true) that returns a generic success response for all verification email requests, regardless of whether the email address is valid, already verified, or non-existent. This prevents an attacker from distinguishing between these cases.

The fix also strengthens the input validation for the related resetPasswordSuccessOnInvalidEmail option, and adds security checks that warn when either enumeration mitigation is disabled.

Workarounds

There is no known workaround.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856
Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.8
Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.34

Risk Scores

Base Score

6.3

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability.

Threat Intelligence

1.7

Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.

EPSS

0.24%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit

Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Related Vulnerabilities

Browse More

Medium severity

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.