Executive brief
Parse Server is a backend framework used to power mobile and web applications. The Keycloak authentication adapter, which integrates Keycloak identity providers with Parse Server, fails to validate the authorized party claim in access tokens. An attacker with a valid token from a different application in the same Keycloak realm can impersonate any user on affected Parse Server instances, leading to unauthorized account access and data compromise.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the Keycloak authentication adapter component of Parse Server. The adapter fails to validate the azp (authorized party) claim of Keycloak access tokens against the configured client-id. The root cause is improper JWT validation that previously relied on a userinfo HTTP call without enforcing claim validation. An attacker with network access and a valid Keycloak access token issued for a different client application within the same Keycloak realm can exploit this to impersonate any user. This requires the target Parse Server deployment to use the Keycloak adapter with a Keycloak realm configured with multiple client applications. The fix implements local JWT verification and enforces azp claim validation. Patches are available in Parse Server 8.6.18 and 9.5.2-alpha.5.
Affected products
- Parse Community Parse Server 0 to 8.6.17; 9.0.0 to 9.5.2-alpha.4
Timeline
- 2026-03-10: disclosed: Vulnerability disclosed via GitHub Security Advisory
- 2026-03-08: patched: Fix released in Parse Server 8.6.18 and 9.5.2-alpha.5