Threats tagged 'bit-parse-2026-33323'

CVE-2026-33323 is a medium-severity vulnerability in parse-community's parse-server prior to versions 8.6.51 and 9.6.0-alpha.40. The issue involves observable response discrepancies in the Pages and legacy PublicAPI routes used for resending email verification links. An unauthenticated attacker can enumerate valid usernames by analyzing different redirect responses depending on whether a username exists and has an unverified email. This vulnerability arises because the emailVerifySuccessOnInvalidEmail configuration, which mitigates enumeration, did not apply to these routes. The flaw allows information disclosure without requiring authentication or user interaction.