CVE-2025-68150 Overview
Parse Server is an open source backend that runs on Node.js infrastructure. The Instagram authentication adapter in versions prior to 8.6.2 and 9.1.1-alpha.1 accepts a client-controlled apiURL parameter within authData. This design flaw enables Server-Side Request Forgery (SSRF) attacks and can result in authentication bypass. Attackers can point the adapter at a malicious endpoint that returns forged responses, allowing unauthorized users to pass validation. The issue is tracked as [CWE-918] and affects deployments that enable the Instagram auth adapter.
Critical Impact
Remote authenticated attackers can forge Instagram authentication responses or coerce the Parse Server into issuing arbitrary HTTP requests to internal network targets.
Affected Products
- Parse Server versions prior to 8.6.2
- Parse Server 9.0.0 through 9.1.0 (including alpha releases)
- Parse Server 9.1.1-alpha releases prior to 9.1.1-alpha.1
Discovery Timeline
- 2025-12-16 - CVE CVE-2025-68150 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-68150
Vulnerability Analysis
The Parse Server Instagram authentication adapter validates user identity by making an HTTP request to Instagram's Graph API. The adapter reads the target URL from the apiURL field inside the client-submitted authData object. Because the server trusts this input without validation, any client can redirect the validation request to an attacker-controlled host.
The adapter then forwards the client-supplied access token to that host and interprets the response as if it came from Instagram. An attacker who hosts a service that returns a valid-looking JSON payload with a chosen Instagram user ID can authenticate as any account that user ID maps to within the Parse application.
The same primitive doubles as an SSRF. The attacker can set apiURL to internal hosts, cloud metadata endpoints such as http://169.254.169.254/, or other services reachable from the Parse Server network boundary.
Root Cause
The root cause is missing input validation on a security-sensitive URL parameter. The adapter treats apiURL as a configuration override instead of a hardcoded trust anchor. This violates the principle that authentication providers must be fixed server-side and never client-controlled.
Attack Vector
Exploitation occurs over the network against the Parse Server authentication endpoint. The attacker submits a sign-in or linking request that includes an authData.instagram object containing a crafted apiURL. The server issues an outbound request to that URL and processes the response as authoritative Instagram data. Full technical context is available in the GitHub Security Advisory GHSA-3f5f-xgrj-97pf.
Detection Methods for CVE-2025-68150
Indicators of Compromise
- Outbound HTTP requests from Parse Server processes to hosts other than graph.instagram.com during Instagram auth flows.
- Authentication requests containing an apiURL key inside authData.instagram payloads.
- Parse Server connections to internal IP ranges or cloud metadata addresses such as 169.254.169.254 originating from the auth adapter.
Detection Strategies
- Inspect application logs for authData payloads that include unexpected keys beyond id and access_token in Instagram login requests.
- Correlate successful Instagram-based account creation or linking events with the destination of the preceding outbound HTTP call.
- Review web application firewall (WAF) logs for POST requests to /parse/users or /parse/login containing the string apiURL.
Monitoring Recommendations
- Enable egress filtering and log all outbound HTTP from Parse Server workloads to a centralized SIEM for review.
- Alert on any Parse Server outbound request to RFC1918 ranges, link-local addresses, or cloud instance metadata endpoints.
- Track Instagram authentication success rates and investigate anomalous spikes that may indicate forged validation responses.
How to Mitigate CVE-2025-68150
Immediate Actions Required
- Upgrade Parse Server to version 8.6.2 or 9.1.1-alpha.1 as published by the Parse Platform maintainers.
- Disable the Instagram authentication adapter until the upgrade is applied if it is not required for production use.
- Restrict outbound network access from Parse Server hosts to known Instagram Graph API endpoints only.
Patch Information
The fix hardcodes the Instagram Graph API URL to https://graph.instagram.com and ignores any client-provided apiURL value. Patch details are published in GitHub Pull Request #9988 and GitHub Pull Request #9989.
Workarounds
- No vendor-provided workarounds exist short of upgrading or disabling the Instagram auth adapter.
- Deploy a reverse proxy or network policy that blocks Parse Server egress to any destination other than graph.instagram.com on port 443.
- Add a WAF rule that rejects authentication requests containing an apiURL field in the authData.instagram object.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
