Executive brief
Parse Server is an open-source backend platform that handles user authentication and data management. The Instagram OAuth adapter in Parse Server contains a vulnerability that allows attackers to perform server-side request forgery attacks by specifying malicious API endpoints, potentially bypassing authentication checks or accessing internal resources. An attacker with low privileges can exploit this without user interaction by providing a custom API URL.
Technical details
The vulnerability is a classic SSRF flaw (CWE-918) in the Instagram authentication adapter component of Parse Server. The root cause is insufficient validation of the apiURL parameter that clients can supply in the authData object. An attacker with low privileges (an authenticated user or someone with basic access) can supply a malicious API URL that the server will then request, allowing them to probe internal networks, access local services, or forge requests to attacker-controlled endpoints. The attack requires network access but no user interaction. The vulnerability was patched by hardcoding the legitimate Instagram Graph API URL (https://graph.instagram.com) and explicitly ignoring any client-provided apiURL parameter, eliminating the SSRF vector.
Affected products
- parse-community parse-server 9.0.0 to <9.1.1-alpha.1; <8.6.2
Timeline
- 2025-12-16: disclosed: Vulnerability disclosed via GHSA advisory
- 2025-12-16: patched: Fixes merged in PR #9988 (alpha branch) and PR #9989 (release-8.x.x branch)