7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30949

CVE-2026-30949: Parse Server missing audience validation in Keycloak authentication adapter

Impact

The Keycloak authentication adapter does not validate the azp (authorized party) claim of Keycloak access tokens against the configured client-id. A valid access token issued by the same Keycloak realm for a different client application can be used to authenticate as any user on the Parse Server that uses the Keycloak adapter. This enables cross-application account takeover in multi-client Keycloak realms.

All Parse Server deployments that use the Keycloak authentication adapter with a Keycloak realm that has multiple client applications are affected.

Patches

The fix replaces the userinfo HTTP call with local JWT verification and enforces azp claim validation against the configured client-id.

Workarounds

None.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-48mh-j4p5-7j9v
Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.5
Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.18

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30949

CVE-2026-30949:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.5.2-alpha.5	9.5.2-alpha.5
parse-server	npm	< 8.6.18	8.6.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Keycloak authentication adapter of Parse Server, where it failed to validate the audience of JWT access tokens. Specifically, the azp (authorized party) claim was not checked against the server's configured client-id. The vulnerable code, found in src/Adapters/Auth/keycloak.js, contained a function named handleAuth. This function would take a user's access_token and use it to query the Keycloak /userinfo endpoint. It then trusted the response if the sub (subject/user ID) claim matched, without verifying which client application the token was issued for. This flaw allowed an attacker with a valid token from a different application within the same Keycloak realm to impersonate any user on the vulnerable Parse Server, leading to account takeover. The patch remediates this by removing the handleAuth function and replacing it with verifyAccessToken, which performs local JWT validation. This new function correctly verifies the token's signature, issuer (iss), and, crucially, the authorized party (azp), ensuring the token is valid for the specific Parse Server application.

Vulnerable functions

handleAuth

src/Adapters/Auth/keycloak.js

This function contained the vulnerable logic. It authenticated a user by calling the Keycloak `userinfo` endpoint but failed to validate that the access token was issued for the correct client application via the `azp` (authorized party) claim. This allowed an attacker with a valid token from another application in the same Keycloak realm to impersonate users on the Parse Server. The function was entirely removed by the patch.

validateAuthData

src/Adapters/Auth/keycloak.js

This is the main entry point for the Keycloak authentication adapter. In the vulnerable version, it directly called the `handleAuth` function, which contained the flawed authentication logic that did not validate the token's audience. Any exploitation of this vulnerability would involve a call to this function. The patch replaces the call to the vulnerable `handleAuth` with a call to the new, secure `verifyAccessToken` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-30949: Parse Server missing audience validation in Keycloak authentication adapter

Impact

Patches

Workarounds

References

CVE-2026-30949:

7.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

7.6

7.6

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-30949: Parse Server missing audience validation in Keycloak authentication adapter

Impact

Patches

Workarounds

References

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI