Parse Server User Enumeration Vulnerability via Email Verification Endpoint

A user enumeration vulnerability has been identified in Parse Server versions prior to 8.6.34 and 9.6.0-alpha.8. The issue arises in the email verification endpoint, which returns different error responses based on the status of the email address. This allows an attacker to send requests with various email addresses and, by observing the error codes, determine which addresses are registered in the application. This vulnerability affects any Parse Server deployment with email verification enabled.

Impact

Exploitation of this vulnerability allows for user enumeration, where an attacker can identify registered email addresses based on the application's response to verification requests.

Remediation

Users can upgrade to Parse Server version 8.6.34 or 9.6.0-alpha.8 to address this vulnerability. Instructions for downloading these versions are available on the Parse Server GitHub Releases page.