Vandellia cirrhosa is a real parasite. It enters the gill chamber of a larger fish, erects short opercular spines to anchor itself, and takes blood from gill filaments before dropping off. That behaviour is well documented.
The human story is not. The idea that candiru home in on urine was tested experimentally in the 1990s and 2000s, notably by the biologist Stephen Spotte, who offered the fish urine, ammonia and other chemical cues in flow tanks. They showed no directed response. The fish instead appear to rely on vision to find host fish at close range, which fits their large eyes relative to body size.
One clinical case, reported from Manaus in 1997, remains the only documented human incident, and its details, including photographs and the surgeon's account, have been questioned by later reviewers. The safest summary is that the risk is far smaller and far less well evidenced than its fame implies.