Parse Server’s email‑verification‑resend pages return different responses based on whether the provided username exists and has an unverified email. A valid username causes a redirect to a success page, while an invalid or already verified account triggers a different redirect. This discrepancy allows an unauthenticated attacker to determine if a user account exists, exposing sensitive information. The weakness is classified as CWE‑204, information exposure through identifier leakage.

All releases of Parse Server before 8.6.51 and before 9.6.0‑alpha.40 are affected, including every 9.6.x alpha up to alpha.39 and earlier stable releases. The vulnerability impacts the Pages route and the legacy PublicAPI route that handle email‑verification‑resend requests, regardless of deployment environment.

The CVSS score of 6.3 indicates moderate severity, and the EPSS figure of less than 1 % suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attack is unauthenticated; an adversary simply submits a username to the resend endpoint and observes the redirect target to enumerate valid accounts.