Description
Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| parse-community | parse-server | 9.0.0 – < 9.10.3-alpha.2, < 8.6.99 | 9.10.3-alpha.2 |