Cyber Resilience

CVE-2026-39321

Parseplatform Parse-Server ≤ 8.6.74

Published
07 April 2026
Modified
15 April 2026
Patch / advisory
View advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0023 14th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-39321 is a medium-severity Observable Timing Discrepancy (CWE-208) vulnerability in Parseplatform Parse-Server. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-11 (Error Handling) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.6 and 8.6.74, he login endpoint response time differs measurably depending on whether the submitted username or email exists in…

more

the database. When a user is not found, the server responds immediately. When a user exists but the password is wrong, a bcrypt comparison runs first, adding significant latency. This timing difference allows an unauthenticated attacker to enumerate valid usernames. This vulnerability is fixed in 9.8.0-alpha.6 and 8.6.74.

CWE(s)
CWE-208

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1087 Account Discovery Discovery
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Timing side-channel on public login endpoint directly enables remote username enumeration (T1087 Account Discovery) via exploitation of a public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-30938Same product: Parseplatform Parse-Server
CVE-2026-35200Same product: Parseplatform Parse-Server
CVE-2026-32098Same product: Parseplatform Parse-Server
CVE-2026-32234Same product: Parseplatform Parse-Server
CVE-2026-34784Same product: Parseplatform Parse-Server
CVE-2026-30854Same product: Parseplatform Parse-Server
CVE-2026-43930Same product: Parseplatform Parse-Server
CVE-2026-30947Same product: Parseplatform Parse-Server
CVE-2026-31800Same product: Parseplatform Parse-Server
CVE-2026-32878Same product: Parseplatform Parse-Server

Affected Assets

parseplatform
parse-server
9.8.0 · ≤ 8.6.74 · 9.0.0 — 9.8.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
Detect
Catch it (NIST detect / respond)
  • SI-4 System Monitoring
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V11.2.4

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces uniform authentication outcomes so that login response timing does not reveal whether an account exists.

SI-11 Error Handling partial match
prevent

Requires consistent error handling paths that eliminate observable timing differences between “user not found” and “invalid password” responses.

SI-4 System Monitoring partial match
detect

Enables monitoring of login endpoint latency patterns that would indicate active username enumeration attempts.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require constant-time implementations that eliminate observable timing discrepancies.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.17 Clock synchronization none match
none

Consistent reference clocks limit the attacker's ability to measure or manipulate timing differences that could reveal internal state or processing paths.

References