Parse Server Keycloak Authentication Adapter Audience Validation Vulnerability Allowing Account Takeover

A vulnerability exists in the Keycloak authentication adapter of Parse Server, specifically in versions prior to 9.5.2-alpha.5 and 8.6.18. The issue arises because the adapter fails to validate the 'azp' (authorized party) claim of Keycloak access tokens against the configured client ID. As a result, a valid access token from the same Keycloak realm but issued for a different client application can be used to authenticate as any user on the Parse Server that utilizes the Keycloak adapter. This flaw facilitates cross-application account takeover in multi-client Keycloak realms. All Parse Server deployments using the Keycloak authentication adapter in such a Keycloak environment are affected.

Impact

Exploitation of this vulnerability allows for unauthorized authentication as any user on the affected Parse Server, leading to potential account takeover.

Remediation

Users can upgrade to Parse Server versions 9.5.2-alpha.5 or 8.6.18 to address this vulnerability.