https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T19:57:51.500498+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-parse-2025-68150 BIT-parse-2025-68150 — Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter 2026-10-19T19:57:51.503236+00:00

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.2 and 9.1.1, the Instagram authentication adapter allows clients to specify a custom API URL via the `apiURL` parameter in `authData`. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users. This is fixed in versions 8.6.2 and 9.1.1 by hardcoding the Instagram Graph API URL `https://graph.instagram.com` and ignoring client-provided `apiURL` values. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/euvd-2026-263886 EUVD-2026-263886 2026-10-19T19:57:51.503284+00:00 EUVD-2026-263886 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68150 fkie_cve-2025-68150 2026-10-19T19:57:51.503300+00:00

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.2 and 9.1.1-alpha.1, the Instagram authentication adapter allows clients to specify a custom API URL via the `apiURL` parameter in `authData`. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users. This is fixed in versions 8.6.2 and 9.1.1-alpha.1 by hardcoding the Instagram Graph API URL `https://graph.instagram.com` and ignoring client-provided `apiURL` values. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/ghsa-3f5f-xgrj-97pf GHSA-3f5f-xgrj-97pf — Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter 2026-10-19T19:57:51.503324+00:00

Affected: npm: parse-server

## Impact

The Instagram authentication adapter allows clients to specify a custom API URL via the `apiURL` parameter in `authData`. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users.

## Patches

Fixed by hardcoding the Instagram Graph API URL `https://graph.instagram.com` and ignoring client-provided `apiURL` values.

## Workarounds

None.