CVE-2026-31901: Parse Server User Enumeration via Email Verification Endpoint
Summary
CVE-2026-31901: Parse Server vulnerable to user enumeration via email verification endpoint. Affects parse-server across 2 version ranges.
< 8.6.34
>= 9.0.0-alpha.1, < 9.6.0-alpha.8
Fixed in 8.6.34 or 9.6.0-alpha.8, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-31901 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that provides a complete solution for building applications. It offers features such as user authentication, data storage, and real-time notifications. However, when email verification is enabled, it can be susceptible to user enumeration attacks, where an attacker can determine valid email addresses by analyzing error responses from the verification endpoint.
Vulnerability Detail
The vulnerability arises from the email verification endpoint ('/verificationEmailRequest') returning distinct error responses based on the status of the email address. This allows attackers to discern whether an email is associated with an existing user, is already verified, or does not exist. As a result, attackers can enumerate valid users, leading to potential privacy breaches and targeted attacks.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.348.6.34npm install parse-server@8.6.34 -
>= 9.0.0-alpha.1, < 9.6.0-alpha.89.6.0-alpha.8npm install parse-server@9.6.0-alpha.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability other than applying the patch. However, you can temporarily disable email verification until the patch is applied.
Conclusion
The CVE-2026-31901 vulnerability in Parse Server allows for user enumeration through the email verification endpoint. It is crucial to update to the patched versions to mitigate this risk and protect user data from potential exploitation.
See every vulnerability recorded for parse-server →
FAQ
User enumeration is a security vulnerability that allows an attacker to determine valid usernames or email addresses in an application by analyzing the responses from the server.
If your application uses Parse Server with email verification enabled, attackers can exploit this vulnerability to identify registered users, potentially leading to targeted attacks.
Versions of Parse Server starting from 0 up to 9.6.0-alpha.7 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 6.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
