Description
Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNT_ALREADY_LINKED(208) was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSION_MISSING(206) for Insufficient auth.
Recommendation
Update the parse-server package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.6.0
- Patched version(s): 3.6.0
References
- GHSA-8w3j-g983-8jh5
- snyk.io
- www.npmjs.com
- www.owasp.org
- CVE-2019-1020013
- CWE-209
- CAPEC-310
- OWASP 2021-A4
- OWASP 2021-A6
Related Issues
- Parse Server crashes with query parameter - CVE-2021-39187
- Prebid.js NPM package briefly compromised - CVE-2025-59038
- Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
- devalue prototype pollution vulnerability - CVE-2025-57820
- Tags:
- npm
- parse-server
Anything's wrong? Let us know Last updated on January 09, 2023