CVE-2026-30949 - Vulnerability Analysis

Overview

Parse Server < 9.5.2-alpha.5 and < 8.6.18 contains an authentication bypass caused by lack of azp claim validation in Keycloak adapter, letting attackers use tokens from other clients to authenticate as any user, exploit requires multi-client Keycloak realm.

Severity & Score

Impact

Attackers can authenticate as any user across applications, enabling cross-application account takeover.

Mitigation

Update to versions 9.5.2-alpha.5 or 8.6.18 or later.

References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-48mh-j4p5-7j9v
• https://github.com/parse-community/parse-server/releases/tag/8.6.18
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner