parse-community/parse-server · Security
Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
- GHSA ID
- GHSA-3f5f-xgrj-97pf
- CVE ID
- CVE-2025-68150
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Description
Impact
The Instagram authentication adapter allows clients to specify a custom API URL via the apiURL parameter in authData. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users.
Patches
Fixed by hardcoding the Instagram Graph API URL https://graph.instagram.com and ignoring client-provided apiURL values.
Workarounds
None.
CWEs
- CWE-918 · Server-Side Request Forgery (SSRF)
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-3f5f-xgrj-97pf ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-68150 ↗
- https://github.com/parse-community/parse-server/pull/9988 ↗
- https://github.com/parse-community/parse-server/pull/9989 ↗
- https://github.com/advisories/GHSA-3f5f-xgrj-97pf ↗