{"id":"GHSA-mmpq-5hcv-hf2v","revision":"6f322d70692a46d692424b319b4ff888","records":[{"revision":"6f322d70692a46d692424b319b4ff888","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-mmpq-5hcv-hf2v","aliases":["BIT-parse-2026-39321","CVE-2026-39321"],"title":"Parse Server has a login timing side-channel reveals user existence","description":"### Impact\n\nThe login endpoint response time differs measurably depending on whether the submitted username or email exists in the database. When a user is not found, the server responds immediately. When a user exists but the password is wrong, a bcrypt comparison runs first, adding significant latency. This timing difference allows an unauthenticated attacker to enumerate valid usernames.\n\n### Patches\n\nA dummy bcrypt comparison is now performed when no user is found, normalizing response timing regardless of user existence. Additionally, accounts without a stored password (e.g. OAuth-only) now also run a dummy comparison to prevent the same timing oracle.\n\n### Workarounds\n\nConfigure rate limiting on the login endpoint to slow automated enumeration. This reduces throughput but does not eliminate the timing signal for individual requests.","state":0,"publishedAt":"2026-04-08T00:07:10+00:00","modifiedAt":"2026-04-15T21:34:44.865456+00:00","affected":[{"ecosystem":"npm","name":"parse-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"9.0.0"},{"kind":"fixed","version":"9.8.0-alpha.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"parse-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"8.6.74"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/parse-community/parse-server/security/advisories/GHSA-mmpq-5hcv-hf2v","https://nvd.nist.gov/vuln/detail/CVE-2026-39321","https://github.com/parse-community/parse-server/pull/10398","https://github.com/parse-community/parse-server/pull/10399","https://github.com/parse-community/parse-server"],"sourceUrl":"https://github.com/advisories/GHSA-mmpq-5hcv-hf2v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mmpq-5hcv-hf2v","identifiers":["GHSA-mmpq-5hcv-hf2v","BIT-parse-2026-39321","CVE-2026-39321"]},"retained":false,"historicalAffected":[]}],"coverage":[]}