Description
Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNT_ALREADY_LINKED(208) was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSION_MISSING(206) for Insufficient auth.
Recommendation
Update the parse-server package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.6.0
- Patched version(s): 3.6.0
References
- GHSA-8w3j-g983-8jh5
- snyk.io
- www.npmjs.com
- www.owasp.org
- CVE-2019-1020013
- CWE-209
- CAPEC-310
- OWASP 2021-A4
- OWASP 2021-A6
Related Issues
- Parse Server crashes with query parameter - CVE-2021-39187
- Parse Server allows public `explain` queries which may expose sensitive database performance information and schema deta - CVE-2025-64502
- Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
- Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format - CVE-2025-64430
- Tags:
- npm
- parse-server
Anything's wrong? Let us know Last updated on January 09, 2023