CVE-2026-30949
Authorization Bypass in Parse Server Keycloak Adapter Enables Account Takeover
Publication date: 2026-03-10
Last updated on: 2026-03-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| parseplatform | parse-server | 9.5.2 |
| parseplatform | parse-server | 9.5.2 |
| parseplatform | parse-server | 9.5.2 |
| parseplatform | parse-server | 9.5.2 |
| parseplatform | parse-server | From 9.0.0 (inc) to 9.5.2 (exc) |
| parseplatform | parse-server | to 8.6.18 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
Can you explain this vulnerability to me?
This vulnerability affects the Parse Server's Keycloak authentication adapter. Before versions 9.5.2-alpha.5 and 8.6.18, the adapter does not properly validate the 'azp' (authorized party) claim in Keycloak access tokens against the configured client-id.
As a result, an access token issued by the same Keycloak realm but for a different client application can be used to authenticate as any user on the Parse Server that uses this Keycloak adapter.
This flaw enables cross-application account takeover in environments where the Keycloak realm has multiple client applications.
How can this vulnerability impact me? :
The vulnerability allows an attacker to use a valid access token from one client application to impersonate any user on the Parse Server that uses the Keycloak adapter.
This can lead to unauthorized access to user accounts across different client applications within the same Keycloak realm, resulting in potential data breaches, unauthorized actions, and loss of user trust.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Parse Server deployment to version 9.5.2-alpha.5 or later, or 8.6.18 or later, where the Keycloak authentication adapter properly validates the azp (authorized party) claim of Keycloak access tokens.
Ensure that your Keycloak realm configuration and client applications are reviewed to prevent cross-application account takeover by enforcing proper token validation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know