6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31901

CVE-2026-31901: Parse Server has user enumeration via email verification endpoint

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to an existing user, is already verified, or does not exist. An attacker can send requests with different email addresses and observe the error codes to determine which email addresses are registered in the application. This is a user enumeration vulnerability that affects any Parse Server deployment with email verification enabled (verifyUserEmails: true). This vulnerability is fixed in 8.6.34 and 9.6.0-alpha.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31901

CVE-2026-31901:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0-alpha.1, < 9.6.0-alpha.8	9.6.0-alpha.8
parse-server	npm	< 8.6.34	8.6.34

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the UsersRouter.handleVerificationEmailRequest function, which handles requests to the /verificationEmailRequest endpoint. Prior to the patch, this function would return different error responses depending on the status of the provided email address. Specifically, it would throw a Parse.Error.EMAIL_NOT_FOUND error if the email did not belong to any user, and a Parse.Error.OTHER_CAUSE error if the email was already verified. This discrepancy in responses allowed an attacker to enumerate valid, registered email addresses by observing the server's response to a series of requests. The provided patch introduces a new configuration option, emailVerifySuccessOnInvalidEmail, which is enabled by default. When enabled, the function returns a generic success response regardless of whether the email exists, is verified, or is invalid, thus preventing the enumeration attack. The analysis of the commit d3defb8 clearly shows the addition of conditional logic within UsersRouter.handleVerificationEmailRequest to return a generic response, directly addressing the information leak.

Vulnerable functions

UsersRouter.handleVerificationEmailRequest

src/Routers/UsersRouter.js

The function `handleVerificationEmailRequest` in `UsersRouter.js` was vulnerable to user enumeration. It would return distinct error messages when an email was not found (`EMAIL_NOT_FOUND`) or was already verified (`OTHER_CAUSE`). An attacker could use these different responses to determine if an email address is registered with the service. The patch mitigates this by returning a generic success response in all cases when the `emailVerifySuccessOnInvalidEmail` option is enabled.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.