CVE-2026-30949: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30949 is an improper authentication vulnerability in the Keycloak authentication adapter of Parse Server, an open-source Node.js backend platform. The adapter fails to validate the azp (authorized party) claim of Keycloak access tokens against the configured client-id, enabling cross-application account takeover in multi-client Keycloak realms. Affected versions include Parse Server 9.0.0 through 9.5.2-alpha.4 and all versions prior to 8.6.18. The vulnerability was published on March 10, 2026, with patches released the same day. It carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 7.6 (High) (GitHub Advisory, Parse Server Advisory).

The root cause is classified as CWE-287 (Improper Authentication): the Keycloak adapter previously relied on a userinfo HTTP call rather than local JWT verification, and did not enforce that the azp claim in the access token matched the Parse Server's configured client-id. An attacker who holds a valid Keycloak access token issued to any other client application within the same realm can present that token to Parse Server's authentication endpoint and be accepted as a legitimate user. The fix replaces the userinfo HTTP call with local JWT verification and adds explicit azp claim validation against the configured client-id (Parse Server Advisory, GitHub Advisory). Exploitation requires the attacker to have a valid token from a sibling client in the same Keycloak realm — a condition that may be met through self-registration on another application sharing the realm.

Successful exploitation allows an attacker with a valid Keycloak access token from any sibling client application in the same realm to authenticate as any user on the affected Parse Server instance, resulting in full account takeover. The confidentiality and integrity of all data accessible through the compromised user accounts are at high risk, including the ability to read, modify, or delete application data. Availability is not directly impacted by this vulnerability. All Parse Server deployments using the Keycloak authentication adapter in a multi-client Keycloak realm are affected (GitHub Advisory, Parse Server Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.046% (15th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation does require the attacker to possess a valid Keycloak access token from a sibling client application in the same realm, which limits the attack surface to environments with multiple client applications sharing a Keycloak realm.

1. Reconnaissance: Identify a Parse Server instance that uses the Keycloak authentication adapter and determine the Keycloak realm it belongs to (e.g., via API responses, documentation, or error messages).
2. Obtain a sibling client token: Register or authenticate with any other client application that shares the same Keycloak realm as the target Parse Server. Obtain a valid Keycloak access token (JWT) issued for that sibling client.
3. Identify target user: Determine the username or user identifier of the Parse Server account to impersonate (e.g., an administrator account).
4. Submit token to Parse Server: Send an authentication request to the Parse Server Keycloak adapter endpoint, supplying the sibling client's access token and the target user's identifier. Because the adapter does not validate the azp claim, it accepts the token as valid for the target user.
5. Achieve account takeover: Parse Server grants a session as the impersonated user, allowing the attacker to read, modify, or delete data accessible to that account (Parse Server Advisory, GitHub Advisory).

• Logs: Parse Server authentication logs showing successful Keycloak logins where the azp claim in the JWT does not match the configured Parse Server client-id; authentication events for high-privilege accounts originating from unexpected IP addresses or at unusual times.
• Network: Keycloak token introspection or userinfo requests from Parse Server using tokens issued to unexpected client applications; API calls to Parse Server authenticated endpoints from IPs not associated with legitimate users.
• Application Behavior: Unexpected data access, modification, or deletion events attributed to user accounts that the legitimate account holders did not perform; multiple successful logins for the same user from different client application contexts in Keycloak audit logs.

Upgrade Parse Server immediately to version 8.6.18 (for the 8.x branch) or 9.5.2-alpha.5 (for the 9.x branch), both released on March 8, 2026 (Parse Server 8.6.18 Release, Parse Server 9.5.2-alpha.5 Release). The vendor confirms there are no configuration-based workarounds; however, as an interim risk-reduction measure, restricting the Keycloak realm to a single client application or disabling the Keycloak authentication adapter until patching is feasible can reduce exposure. Review Keycloak and Parse Server access logs for suspicious cross-application authentication attempts after patching.