Parse Server exposes a timing side-channel that allows an unauthenticated attacker to distinguish between non‐existent and existing usernames. The vulnerability arises because the login endpoint returns immediately when a user is not found, but introduces a measurable delay when the username exists and the password is wrong due to a bcrypt comparison. This difference reveals the existence of accounts, posing a risk of credential stuffing or targeted attacks. The weakness is classified as CWE‑208, indicating a privacy exposure due to cryptographic timing differences.

The affected product is the Parse Server open‑source backend, maintained by the parse-community. Versions prior to 9.8.0‑alpha.6 and 8.6.74 are vulnerable. Down‑stream deployments running these legacy releases, regardless of hosting environment, are at risk.

The CVSS score of 6.3 reflects a moderate severity, primarily driven by the potential for user enumeration rather than direct code execution. EPSS data is unavailable, but the attack does not require advanced skills beyond measuring response times, making it accessible to a broad range of adversaries. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly confirmed exploitation yet, yet the risk remains significant because enumeration can precede more destructive attacks.