A vulnerability in the Parse Server Keycloak authentication adapter allows attackers to bypass identity verification and perform cross-application account takeovers.

This is an improper authentication flaw (CWE-287) occurring within the Keycloak authentication adapter. An attacker with a valid access token from a different application within the same Keycloak realm can authenticate as any user on the Parse Server, provided the user has a logged-in session or account presence.

Successful exploitation of this vulnerability leads to full account takeover, which can result in unauthorized access to sensitive backend data, modification of user records, and potential escalation of privileges within the application. Given the CVSS score of 8.8, this represents a high-severity risk that could severely compromise the integrity and confidentiality of any Parse Server deployment utilizing Keycloak for authentication in a shared realm environment.

Immediate Action: Update Parse Server to version 9.5.2-alpha.5 or 8.6.18 to incorporate the necessary validation logic for the Keycloak authorized party claim.

Proactive Monitoring: Review authentication logs for anomalous login patterns, specifically focusing on users authenticating from unexpected client IDs or tokens that do not align with expected application identifiers.

Compensating Controls: If immediate patching is not feasible, restrict the Keycloak configuration to ensure that the Parse Server instance is isolated within its own dedicated realm, preventing cross-client token abuse.

Public Exploit Available: No

This vulnerability presents a significant risk to the integrity of user authentication in Parse Server environments. Administrators must prioritize updating to the fixed versions immediately to prevent potential cross-application account takeovers. Failure to patch leaves the backend infrastructure susceptible to unauthorized access by any actor possessing a valid token within the shared Keycloak realm.