parse-community parse-server up to 8.6.17/9.0.0 9.5.2-alpha.4 improper authentication

Summaryinfo

A vulnerability, which was classified as critical, was found in parse-community parse-server up to 8.6.17/9.0.0 9.5.2-alpha.4. Affected by this vulnerability is an unknown functionality. Such manipulation leads to improper authentication. This vulnerability is referenced as CVE-2026-30949. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in parse-community parse-server up to 8.6.17/9.0.0 9.5.2-alpha.4 and classified as critical. Affected by this issue is some unknown functionality. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp (authorized party) claim of Keycloak access tokens against the configured client-id. A valid access token issued by the same Keycloak realm for a different client application can be used to authenticate as any user on the Parse Server that uses the Keycloak adapter. This enables cross-application account takeover in multi-client Keycloak realms. All Parse Server deployments that use the Keycloak authentication adapter with a Keycloak realm that has multiple client applications are affected. This vulnerability is fixed in 9.5.2-alpha.5 and 8.6.18.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-30949 since 03/07/2026. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 8.6.18 or 9.0.0 9.5.2-alpha.5 eliminates this vulnerability. The upgrade is hosted for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• parse-community

Name

• parse-server

Version

• 8.6.0
• 8.6.1
• 8.6.2
• 8.6.3
• 8.6.4
• 8.6.5
• 8.6.6
• 8.6.7
• 8.6.8
• 8.6.9
• 8.6.10
• 8.6.11
• 8.6.12
• 8.6.13
• 8.6.14
• 8.6.15
• 8.6.16
• 8.6.17
• 9.0.0 9.5.2-alpha.0
• 9.0.0 9.5.2-alpha.1
• 9.0.0 9.5.2-alpha.2
• 9.0.0 9.5.2-alpha.3
• 9.0.0 9.5.2-alpha.4

Website

• Product: https://github.com/parse-community/parse-server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion