CVE-2026-30949

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp (authorized party) claim of Keycloak access tokens against the configured client-id. A valid access token issued by the same Keycloak realm for a different client application can be used to authenticate as any user on the Parse Server that uses the Keycloak adapter. This enables cross-application account takeover in multi-client Keycloak realms. All Parse Server deployments that use the Keycloak authentication adapter with a Keycloak realm that has multiple client applications are affected. This vulnerability is fixed in 9.5.2-alpha.5 and 8.6.18.

• CWE-287

• https://github.com/parse-community/parse-server/releases/tag/8.6.18Product, Release Notes
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.5Product, Release Notes
• https://github.com/parse-community/parse-server/security/advisories/GHSA-48mh-j4p5-7j9vPatch, Vendor Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30943Gokapi is a self-hosted file sharing server with automatic e…4.1
• CVE-2026-30944StudioCMS is a server-side-rendered, Astro native, headless …8.8
• CVE-2026-30945StudioCMS is a server-side-rendered, Astro native, headless …7.1
• CVE-2026-30946Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-30947Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-30948Parse Server is an open source backend that can be deployed …5.4
• CVE-2026-30950AutoGPT is a workflow automation platform for creating, depl…7.1
• CVE-2026-30951Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is S…7.5
• CVE-2026-30952liquidjs is a Shopify / GitHub Pages compatible template eng…7.5
• CVE-2026-30953LinkAce is a self-hosted archive to collect website links. W…6.5
• CVE-2026-30954LinkAce is a self-hosted archive to collect website links. I…4.3
• CVE-2026-30955Gokapi is a self-hosted file sharing server with automatic e…6.5