What is GHSA-3f5f-xgrj-97pf?

GHSA-3f5f-xgrj-97pf is a security advisory published by GitHub Security Advisories with High severity. Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter

Which CVE IDs does GHSA-3f5f-xgrj-97pf cover?

GHSA-3f5f-xgrj-97pf covers the following CVE IDs: CVE-2025-68150. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-3f5f-xgrj-97pf?

GHSA-3f5f-xgrj-97pf affects 2 products, including: npm/parse-server:\u003c 8.6.2; npm/parse-server:\u003e= 9.0.0, \u003c 9.1.1-alpha.1.

GHSA-3f5f-xgrj-97pfHigh

Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter

Vendor

GitHub Security Advisories

Published

December 16, 2025

Last Modified

January 7, 2026

🔗 CVE IDs covered (1)

CVE-2025-68150 →

📋 Description

Impact

The Instagram authentication adapter allows clients to specify a custom API URL via the apiURL parameter in authData. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users.

Patches

Fixed by hardcoding the Instagram Graph API URL https://graph.instagram.com and ignoring client-provided apiURL values.

Workarounds

None.

🎯 Affected products2

npm/parse-server:< 8.6.2
npm/parse-server:>= 9.0.0, < 9.1.1-alpha.1

🔗 References (5)

https://github.com/parse-community/parse-server/security/advisories/GHSA-3f5f-xgrj-97pf
https://nvd.nist.gov/vuln/detail/CVE-2025-68150
https://github.com/parse-community/parse-server/pull/9988
https://github.com/parse-community/parse-server/pull/9989
https://github.com/advisories/GHSA-3f5f-xgrj-97pf