{"id":"EUVD-2026-19818","enisaUuid":"8f4f9c52-6000-3483-a2f7-825a82a30e34","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.6 and 8.6.74, he login endpoint response time differs measurably depending on whether the submitted username or email exists in the database. When a user is not found, the server responds immediately. When a user exists but the password is wrong, a bcrypt comparison runs first, adding significant latency. This timing difference allows an unauthenticated attacker to enumerate valid usernames. This vulnerability is fixed in 9.8.0-alpha.6 and 8.6.74.","datePublished":"Apr 7, 2026, 6:11:10 PM","dateUpdated":"Apr 7, 2026, 7:58:57 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-mmpq-5hcv-hf2v\nhttps://github.com/parse-community/parse-server/pull/10398\nhttps://github.com/parse-community/parse-server/pull/10399\n","aliases":"CVE-2026-39321\n","assigner":"GitHub_M","epss":0.23,"enisaIdProduct":[{"id":"8894a757-fd1c-399b-addf-3dad497d2c31","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0, \u003c 9.8.0-alpha.6"},{"id":"95c7cd6d-8b1c-38dd-8d70-a43e408bc5dc","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.74"}],"enisaIdVendor":[{"id":"fe9be935-8029-3708-acf6-86794a5a47bb","vendor":{"name":"parse-community"}}],"enisaIdVulnerability":[{"id":"d02324d4-2414-33b0-8af8-8760510a98d7","vulnerability":{"id":"CVE-2026-39321","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.6 and 8.6.74, he login endpoint response time differs measurably depending on whether the submitted username or email exists in the database. When a user is not found, the server responds immediately. When a user exists but the password is wrong, a bcrypt comparison runs first, adding significant latency. This timing difference allows an unauthenticated attacker to enumerate valid usernames. This vulnerability is fixed in 9.8.0-alpha.6 and 8.6.74.","datePublished":"Apr 7, 2026, 6:11:10 PM","dateUpdated":"Apr 7, 2026, 7:58:57 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-mmpq-5hcv-hf2v\nhttps://github.com/parse-community/parse-server/pull/10398\nhttps://github.com/parse-community/parse-server/pull/10399\n","enisa_id":"EUVD-2026-19818\n","assigner":"GitHub_M","epss":0.23,"dataProcessed":"Oct 27, 2026, 7:13:18 AM","vulnerabilityProduct":[{"id":"055a86ae-9a84-3582-bb59-f8dd2f80b3c4","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.74"},{"id":"6b414a18-e1c2-3e69-af0d-448d6f9e4730","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0, \u003c 9.8.0-alpha.6"}],"vulnerabilityVendor":[{"id":"b59c3c13-a50a-3e17-a57b-97e7fab38b7e","vendor":{"name":"parse-community"}}]}}],"enisaIdAdvisory":[]}