CVE-2025-68150

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.2 and 9.1.1-alpha.1, the Instagram authentication adapter allows clients to specify a custom API URL via the `apiURL` parameter in `authData`. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users. This is fixed in versions 8.6.2 and 9.1.1-alpha.1 by hardcoding the Instagram Graph API URL `https://graph.instagram.com` and ignoring client-provided `apiURL` values. No known workarounds are available.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
parse-community	parse-server	< 8.6.2; >= 9.0.0, < 9.1.1-alpha.1

References

https://github.com/parse-community/parse-server/pull/9988Issue Tracking, Patch
https://github.com/parse-community/parse-server/pull/9989Issue Tracking, Patch
https://github.com/parse-community/parse-server/security/advisories/GHSA-3f5f-xgrj-97pfThird Party Advisory

Timeline

Published: Dec 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-681517.5CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack CVE-2025-681524.9Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through sp CVE-2025-681536.5Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through sp CVE-2025-681548.1systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminforma CVE-2025-681557.5@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoi CVE-2025-681567.5Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flat CVE-2025-681573.7Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpU CVE-2025-681588.8Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token CVE-2025-68163.3A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /CVE-2025-681604.7Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes ca CVE-2025-681614.8The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificat CVE-2025-681622.7In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration