CVE-2026-30949: Parse Server missing audience validation in Keycloak authentication adapter
The Keycloak authentication adapter does not validate the azp (authorized party) claim of Keycloak access tokens against the configured client-id. A valid access token issued by the same Keycloak realm for a different client application can be used to authenticate as any user on the Parse Server that uses the Keycloak adapter. This enables cross-application account takeover in multi-client Keycloak realms.
All Parse Server deployments that use the Keycloak authentication adapter with a Keycloak realm that has multiple client applications are affected.
References
- github.com/advisories/GHSA-48mh-j4p5-7j9v
- github.com/parse-community/parse-server
- github.com/parse-community/parse-server/releases/tag/8.6.18
- github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.5
- github.com/parse-community/parse-server/security/advisories/GHSA-48mh-j4p5-7j9v
- nvd.nist.gov/vuln/detail/CVE-2026-30949
Code Behaviors & Features
Detect and mitigate CVE-2026-30949 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →