CVE-2025-68150
SSRF and Auth Bypass in Parse Server Instagram Adapter
Publication date: 2025-12-16
Last updated on: 2025-12-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| parse_server | parse_server | * |
| parse | parse_server | 8.6.2 |
| parse | parse_server | 9.1.1-alpha.1 |
| parse | parse_server | 9.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68150 is a Server-Side Request Forgery (SSRF) vulnerability in the Instagram authentication adapter of Parse Server. Before fixed versions, the adapter allowed clients to specify a custom API URL via the apiURL parameter in authData. This flaw enabled attackers to make the server send requests to arbitrary URLs, potentially allowing unauthorized internal network requests and authentication bypass if malicious endpoints returned crafted responses. The vulnerability was fixed by hardcoding the Instagram Graph API URL and ignoring client-provided apiURL values. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can allow attackers to perform SSRF attacks by making the server send requests to arbitrary endpoints, potentially accessing internal network resources. It may also enable authentication bypass if attackers control endpoints that return fake responses validating unauthorized users. This can lead to unauthorized data disclosure and compromise of system security. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2025-68150, immediately upgrade your Parse Server to version 8.6.2 or later, or to version 9.1.1-alpha.1 or later. These versions include a fix that hardcodes the Instagram Graph API URL and ignores any client-provided apiURL values, preventing SSRF attacks and authentication bypass. No other workarounds are available. [1, 2, 3]