CVE-2026-30949: Parse Server Auth Bypass Vulnerability

CVE-2026-30949 Overview

CVE-2026-30949 is an authentication bypass vulnerability in Parse Server, an open source backend that can be deployed to any infrastructure that can run Node.js. The vulnerability exists in the Keycloak authentication adapter, which fails to properly validate the azp (authorized party) claim of Keycloak access tokens against the configured client-id. This flaw enables cross-application account takeover in multi-client Keycloak realms, allowing attackers with valid access tokens from other client applications within the same realm to impersonate any user on the affected Parse Server deployment.

Critical Impact

This vulnerability enables cross-application account takeover, allowing attackers to authenticate as any user on Parse Server deployments using the Keycloak adapter within multi-client realms.

Affected Products

• parseplatform parse-server versions prior to 8.6.18
• parseplatform parse-server versions 9.5.2-alpha.1 through 9.5.2-alpha.4
• All Parse Server deployments using Keycloak authentication adapter with multi-client realms

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-30949 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30949

Vulnerability Analysis

The vulnerability stems from improper authentication (CWE-287) in the Keycloak authentication adapter implementation. When Parse Server processes Keycloak access tokens for authentication, it validates that the token was issued by the configured Keycloak realm but fails to verify that the token was specifically issued for the Parse Server application. The missing validation of the azp (authorized party) claim means any valid token from the same Keycloak realm—regardless of which client application it was originally issued to—will be accepted.

This architectural flaw becomes particularly dangerous in organizations using Keycloak to manage authentication across multiple applications. An attacker who has legitimate access to any application within the same Keycloak realm can leverage their valid access token to gain unauthorized access to the Parse Server deployment, effectively impersonating any user.

Root Cause

The root cause is the absence of azp claim validation in the Keycloak authentication adapter. The azp claim in OAuth 2.0/OIDC tokens identifies the authorized party—the client application for which the token was issued. Without validating this claim against the Parse Server's configured client-id, the adapter cannot distinguish between tokens intended for Parse Server and tokens issued for other applications in the same realm.

Attack Vector

The attack leverages the network-accessible Parse Server API endpoint. An attacker must first obtain a valid Keycloak access token from any client application registered in the same Keycloak realm as the target Parse Server. This could be achieved through legitimate access to another application or by compromising credentials for a different service.

Once in possession of a valid token from the shared realm, the attacker presents this token to Parse Server's authentication endpoint. Due to the missing azp validation, Parse Server accepts the token as valid and grants access based on the user claims within the token, enabling complete account takeover without requiring any credentials specific to Parse Server.

Detection Methods for CVE-2026-30949

Indicators of Compromise

• Authentication requests to Parse Server with Keycloak tokens containing azp claims that do not match the configured Parse Server client-id
• User account access from unexpected client applications within the Keycloak realm
• Anomalous authentication patterns showing users authenticating via tokens issued to different applications
• Sudden access to user accounts without corresponding login activity on Parse Server's intended frontend

Detection Strategies

• Implement logging that captures and records the azp claim from all Keycloak tokens processed by Parse Server
• Monitor authentication logs for tokens where the azp claim differs from the expected Parse Server client-id
• Cross-reference Parse Server authentication events with Keycloak's token issuance logs to identify mismatched client applications
• Deploy runtime application security monitoring to detect authentication bypass attempts

Monitoring Recommendations

• Enable verbose logging on Parse Server authentication endpoints to capture full token metadata
• Configure alerts for authentication events using tokens with unexpected azp values
• Establish baseline authentication patterns and monitor for deviations indicating potential cross-application attacks
• Review Keycloak audit logs for token requests that may indicate reconnaissance of the realm's client applications

How to Mitigate CVE-2026-30949

Immediate Actions Required

• Upgrade Parse Server to version 8.6.18 or 9.5.2-alpha.5 immediately
• Audit authentication logs to identify any potential exploitation prior to patching
• Review all client applications registered in the affected Keycloak realm for suspicious activity
• Consider temporarily disabling Keycloak authentication adapter until patching is complete if cross-application attacks are suspected

Patch Information

The vulnerability is fixed in Parse Server versions 8.6.18 and 9.5.2-alpha.5. Users should upgrade to these versions as soon as possible. For detailed release information, see the GitHub Parse Server Release 8.6.18 or GitHub Parse Server Release 9.5.2-alpha.5. Additional technical details are available in the GitHub Security Advisory GHSA-48mh-j4p5-7j9v.

Workarounds

• Isolate Parse Server to a dedicated Keycloak realm with no other client applications if immediate patching is not feasible
• Implement network-level access controls to restrict which systems can reach Parse Server authentication endpoints
• Deploy a reverse proxy or API gateway that validates the azp claim before forwarding requests to Parse Server
• Consider switching to an alternative authentication adapter until the Parse Server instance can be upgraded

# Upgrade Parse Server to patched version
npm update parse-server@8.6.18
# Or for the alpha branch
npm update parse-server@9.5.2-alpha.5