CVE-2026-31901 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to an existing user, is already verified, or does not exist. An attacker can send requests with different email addresses and observe the error codes to determine which email addresses are registered in the application. This is a user enumeration vulnerability that affects any Parse Server deployment with email verification enabled (verifyUserEmails: true). This vulnerability is fixed in 8.6.34 and 9.6.0-alpha.8.
A user enumeration vulnerability has been identified in Parse Server versions prior to 8.6.34 and 9.6.0-alpha.8. The issue arises in the email verification endpoint, which returns different error responses based on the status of the email address. This allows an attacker to send requests with various email addresses and, by observing the error codes, determine which addresses are registered in the application. This vulnerability affects any Parse Server deployment with email verification enabled.
Users can upgrade to Parse Server version 8.6.34 or 9.6.0-alpha.8 to address this vulnerability. Instructions for downloading these versions are available on the Parse Server GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/releases/tag/8.6.34 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.8 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-204 | Observable Response Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.34 >= 9.0.0, < 9.6.0 9.6.0 alpha1 9.6.0 alpha2 9.6.0 alpha3 9.6.0 alpha4 9.6.0 alpha5 9.6.0 alpha6 9.6.0 alpha7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | New CVE Received | [email protected] |