CVE-2026-30949: Parse Server is missing audience validation in Keycloak authentication adapter

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-10 · updated 2026-06-17
Weakness: CWE-287

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp (authorized party) claim of Keycloak access tokens against the configured client-id. A valid access token issued by the same Keycloak realm for a different client application can be used to authenticate as any user on the Parse Server that uses the Keycloak adapter. This enables cross-application account takeover in multi-client Keycloak realms. All Parse Server deployments that use the Keycloak authentication adapter with a Keycloak realm that has multiple client applications are affected. This vulnerability is fixed in 9.5.2-alpha.5 and 8.6.18.

Affected products

parse-community parse-server: before 8.6.18; from 9.0.0 before 9.5.2; 9.5.2-alpha1, 9.5.2-alpha2, 9.5.2-alpha3, 9.5.2-alpha4 — fixed in 8.6.18, 9.5.2

How to fix

Upgrade to a fixed version: parse-community parse-server 8.6.18, 9.5.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-30949 or the next vulnerability affects your stack