| Package | Affected versions | Patched versions |
|---|---|---|
| parse-server | < 3.6.0 | 3.6.0 |
| parse-server | < 3.6.0 | 3.6.0 |
Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking.
ParseError.ACCOUNT_ALREADY_LINKED(208) was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSION_MISSING(206) for Insufficient auth. An attacker can guess ids and get information about linked accounts/email addresses.
If you have any questions or comments about this advisory, Open an issue in the parse-server Parse Community Vulnerability Disclosure Program
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free