Sign in
Deutsch English Español Polski
High

Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter

  • Disclosed: 16.12.2025
  • Updated: 11.10.2026 10:22

Impact

The Instagram authentication adapter allows clients to specify a custom API URL via the apiURL parameter in authData. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users.

Patches

Fixed by hardcoding the Instagram Graph API URL https://graph.instagram.com and ignoring client-provided apiURL values.

Workarounds

None.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package parse-server >= 9.0.0, < 9.1.1-alpha.1, < 8.6.2 9.1.1-alpha.1, 8.6.2

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness (CWE)
CWE-918
Platform
npm
Package
parse-server
Disclosed
16.12.2025
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-3f5f-xgrj-97pf - CC BY 4.0

Vulnerability history: parse-server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (116) in the archive
Total entries
116
First → latest
06.2019 06.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 17
  • High 49
  • Medium 40
  • Low 10

Disclosures per year

Severity:
  1. Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter this entry
    High CVE-2025-68150 >= 9.0.0, < 9.1.1-alpha.1, < 8.6.2 9.1.1-alpha.1, 8.6.2
  2. parse-server: Denial of service via exponential-time processing of deeply nested query operators
    High CVE-2026-57480 >= 9.0.0, < 9.9.1-alpha.12, < 8.6.82 9.9.1-alpha.12, 8.6.82
  3. Parse Server: Pre-authentication denial of service via client version header regex backtracking
    High CVE-2026-47138 >= 9.0.0, < 9.9.1-alpha.1, < 8.6.77 9.9.1-alpha.1, 8.6.77
  4. Parser Server's streaming file download bypasses afterFind file trigger authorization
    High CVE-2026-34784 >= 9.0.0, < 9.7.1-alpha.1, < 8.6.71 9.7.1-alpha.1, 8.6.71
  5. parse-server has GraphQL complexity validator exponential fragment traversal DoS
    High CVE-2026-34573 >= 9.0.0, < 9.7.0-alpha.12, < 8.6.68 9.7.0-alpha.12, 8.6.68
  6. parse-server has cloud function validator bypass via prototype chain traversal
    Critical CVE-2026-34532 >= 9.0.0, < 9.7.0-alpha.11, < 8.6.67 9.7.0-alpha.11, 8.6.67
  7. LiveQuery protected field leak via shared mutable state across concurrent subscribers
    High CVE-2026-34363 >= 9.0.0, < 9.7.0-alpha.9, < 8.6.65 9.7.0-alpha.9, 8.6.65
  8. Parse Server exposes auth data via verify password endpoint
    High CVE-2026-34215 >= 9.0.0, < 9.7.0-alpha.7, < 8.6.63 9.7.0-alpha.7, 8.6.63
  9. Parse Server exposes auth data via /users/me endpoint
    High CVE-2026-33627 >= 9.0.0, < 9.6.0-alpha.55, < 8.6.61 9.6.0-alpha.55, 8.6.61
  10. Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
    High CVE-2026-33539 >= 9.0.0, < 9.6.0-alpha.53, < 8.6.59 9.6.0-alpha.53, 8.6.59
  11. Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
    High CVE-2026-33538 >= 9.0.0, < 9.6.0-alpha.52, < 8.6.58 9.6.0-alpha.52, 8.6.58
  12. Parse Server LiveQuery subscription query depth bypass
    High · 7.5 CVE-2026-33508 >= 9.0.0, < 9.6.0-alpha.45, < 8.6.56 9.6.0-alpha.45, 8.6.56
  13. Parse Server has a query condition depth bypass via pre-validation transform pipeline
    High · 7.5 CVE-2026-33498 >= 9.0.0, < 9.6.0-alpha.44, < 8.6.55 9.6.0-alpha.44, 8.6.55
  14. Parse Server's LiveQuery bypasses CLP pointer permission enforcement
    High · 6.5 CVE-2026-33421 >= 9.0.0, < 9.6.0-alpha.42, < 8.6.53 9.6.0-alpha.42, 8.6.53
  15. Parse Server has an auth provider validation bypass on login via partial authData
    High · 9.1 CVE-2026-33409 >= 9.0.0, < 9.6.0-alpha.41, < 8.6.52 9.6.0-alpha.41, 8.6.52
  16. Parse Server leaks protected fields via LiveQuery afterEvent trigger
    High CVE-2026-33163 >= 9.0.0, < 9.6.0-alpha.35, < 8.6.50 9.6.0-alpha.35, 8.6.50
  17. Parse Server's Cloud function dispatch crashes server via prototype chain traversal
    High CVE-2026-32886 >= 9.0.0, < 9.6.0-alpha.24, < 8.6.47 9.6.0-alpha.24, 8.6.47
  18. Parse Server crash via deeply nested query condition operators
    High CVE-2026-32944 >= 9.0.0, < 9.6.0-alpha.21, < 8.6.45 9.6.0-alpha.21, 8.6.45
  19. Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
    High CVE-2026-32728 >= 9.0.0, < 9.6.0-alpha.15, < 8.6.41 9.6.0-alpha.15, 8.6.41
  20. Parse Server: Account takeover via operator injection in authentication data identifier
    Critical CVE-2026-32248 >= 9.0.0, < 9.6.0-alpha.12, < 8.6.38 9.6.0-alpha.12, 8.6.38
  21. Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
    Critical CVE-2026-32242 >= 9.0.0, < 9.6.0-alpha.11, < 8.6.37 9.6.0-alpha.11, 8.6.37
Show more (20) Showing 21 of 66

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.