What’s Vulnerable › Vulnerabilities
CVE-2025-68662: FinalDestination hostname matching allows SSRF protection bypass
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-01-28 · updated 2026-06-17
- Weakness: CWE-918
Description
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.
Affected products
- discourse: before 3.5.4; from 2025.11.0 before 2025.11.2; 2025.12.0, 2026.1.0 — fixed in 2025.11.2, 3.5.4
How to fix
Upgrade to a fixed version: discourse 2025.11.2, 3.5.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-68662 or the next vulnerability affects your stack