CVE-2026-30949

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.5 Parse Server versions prior to 8.6.18

Description Parse Server, an open source backend deployable on Node.js infrastructures, contains a flaw in its Keycloak authentication adapter. Specifically, the adapter fails to validate the azp (authorized party) claim within Keycloak access tokens against the expected client-id. This allows a valid access token from a different client application within the same Keycloak realm to be used for authentication, potentially leading to cross-application account takeover. Deployments utilizing the Keycloak authentication adapter with multi-client Keycloak realms are susceptible. The issue affects all Parse Server deployments using the Keycloak authentication adapter with a Keycloak realm that has multiple client applications.

Recommendations Update to Parse Server version 9.5.2-alpha.5 or later. Update to Parse Server version 8.6.18 or later.