CVE-2025-68150
Unknown Unknown - Not Provided
SSRF and Auth Bypass in Parse Server Instagram Adapter

Publication date: 2025-12-16

Last updated on: 2025-12-16

Assigner: GitHub, Inc.

Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.2 and 9.1.1-alpha.1, the Instagram authentication adapter allows clients to specify a custom API URL via the `apiURL` parameter in `authData`. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users. This is fixed in versions 8.6.2 and 9.1.1-alpha.1 by hardcoding the Instagram Graph API URL `https://graph.instagram.com` and ignoring client-provided `apiURL` values. No known workarounds are available.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-16
Last Modified
2025-12-16
Generated
2026-06-16
AI Q&A
2025-12-16
EPSS Evaluated
2026-06-15
NVD
CVE-2025-68150
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
parse_server parse_server *
parse parse_server 8.6.2
parse parse_server 9.1.1-alpha.1
parse parse_server 9.1.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-68150 is a Server-Side Request Forgery (SSRF) vulnerability in the Instagram authentication adapter of Parse Server. Before fixed versions, the adapter allowed clients to specify a custom API URL via the apiURL parameter in authData. This flaw enabled attackers to make the server send requests to arbitrary URLs, potentially allowing unauthorized internal network requests and authentication bypass if malicious endpoints returned crafted responses. The vulnerability was fixed by hardcoding the Instagram Graph API URL and ignoring client-provided apiURL values. [1, 2, 3]

Impact Analysis

This vulnerability can allow attackers to perform SSRF attacks by making the server send requests to arbitrary endpoints, potentially accessing internal network resources. It may also enable authentication bypass if attackers control endpoints that return fake responses validating unauthorized users. This can lead to unauthorized data disclosure and compromise of system security. [1, 3]

Mitigation Strategies

To mitigate CVE-2025-68150, immediately upgrade your Parse Server to version 8.6.2 or later, or to version 9.1.1-alpha.1 or later. These versions include a fix that hardcodes the Instagram Graph API URL and ignores any client-provided apiURL values, preventing SSRF attacks and authentication bypass. No other workarounds are available. [1, 2, 3]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68150. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart