PT-2026-24802 · Bitnami+4 · Parse+1

0Xkakash1 · Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-31901

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.34 Parse Server versions prior to 9.6.0-alpha.8

Description Parse Server, an open source backend deployable on Node.js infrastructures, is affected by a user enumeration issue. The /verificationEmailRequest API endpoint returns different error responses based on whether an email address is registered, already verified, or non-existent. An attacker can send requests with various email addresses and analyze the error codes to determine which email addresses are associated with existing user accounts. This issue impacts any Parse Server deployment where email verification is enabled (verifyUserEmails: true). A fix introduces the emailVerifySuccessOnInvalidEmail option, which, when enabled, returns a generic success response for all verification email requests, preventing differentiation between valid, verified, and non-existent email addresses. The fix also includes strengthened input validation for the resetPasswordSuccessOnInvalidEmail option and security checks to warn when enumeration mitigation is disabled.

Recommendations Parse Server versions prior to 8.6.34: Upgrade to version 8.6.34 or later. Parse Server versions prior to 9.6.0-alpha.8: Upgrade to version 9.6.0-alpha.8 or later.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

BIT-PARSE-2026-31901

CVE-2026-31901

GHSA-W54V-HF9P-8856

Affected Products

Parse

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31901.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31901 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-31901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31901 · Security Note
• https://osv.dev/vulnerability/GHSA-w54v-hf9p-8856 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.8 · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.34 · Note
• https://twitter.com/infoflowcloud/status/2031869692285997497 · Twitter Post
• https://twitter.com/CVEnew/status/2031867681188528359 · Twitter Post