CVE-2026-30949 PUBLISHED

Parse Server is missing audience validation in Keycloak authentication adapter

Assigner: GitHub_M
Reserved: 07.03.2026 Published: 10.03.2026 Updated: 10.03.2026

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp (authorized party) claim of Keycloak access tokens against the configured client-id. A valid access token issued by the same Keycloak realm for a different client application can be used to authenticate as any user on the Parse Server that uses the Keycloak adapter. This enables cross-application account takeover in multi-client Keycloak realms. All Parse Server deployments that use the Keycloak authentication adapter with a Keycloak realm that has multiple client applications are affected. This vulnerability is fixed in 9.5.2-alpha.5 and 8.6.18.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.6

Product Status

Vendor parse-community
Product parse-server
Versions
  • Version >= 9.0.0 < 9.5.2-alpha.5 is affected
  • Version < 8.6.18 is affected

References

Problem Types

  • CWE-287: Improper Authentication CWE