BIT-parse-2026-112768 — Parse Server before 8.6.99 and 9.x before 9.10.3: Information Disclosure via User Update

Affected Parse Server versions evaluate checks against the target account before authorizing the caller and reflect the outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or email addresses and, under certain password-policy settings, guessed current or previous passwords.