CVE-2025-68662: FinalDestination hostname matching allows SSRF protection bypass
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68662?
CVE-2025-68662 is classified as a medium severity vulnerability due to its potential to bypass SSRF protections.
How do I fix CVE-2025-68662?
To fix CVE-2025-68662, upgrade to Discourse version 3.5.4 or later, or to 2025.11.2, 2025.12.1, or 2026.1.0.
Which versions are affected by CVE-2025-68662?
CVE-2025-68662 affects Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0.
What type of vulnerability is CVE-2025-68662?
CVE-2025-68662 is a hostname validation issue that can allow the bypassing of SSRF protections in affected Discourse versions.
Is CVE-2025-68662 related to Discourse's server functionality?
Yes, CVE-2025-68662 impacts the server functionality of Discourse by compromising its SSRF protection mechanisms.