CVE-2026-39321
Parse Server has a login timing side-channel reveals user existence
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0 and 8.6.74, he login endpoint response time differs measurably depending on whether the submitted username or email exists in the database. When a user is not found, the server responds immediately. When a user exists but the password is wrong, a bcrypt comparison runs first, adding significant latency. This timing difference allows an unauthenticated attacker to enumerate valid usernames. This vulnerability is fixed in 9.8.0 and 8.6.74.
How to fix CVE-2026-39321
To remediate CVE-2026-39321, upgrade the affected package to a fixed version below.
- —upgrade to 8.6.74 or later
- —upgrade to 9.8.0-alpha.6 or later
Is CVE-2026-39321 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 8.6.74, >= 9.0.0, < 9.8.0
- >= 9.0.0, < 9.8.0-alpha.6
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | LOW3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |