CVE-2025-68662 — FinalDestination hostname matching allows SSRF protection bypass

CVE-2025-68662

FinalDestination hostname matching allows SSRF protection bypass PUBLISHED

Description (CNA)

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

Affected (CNA)

Vendor / product	Versions
discourse / discourse	affected < 3.5.4; affected >= 2025.11.0-latest, < 2025.11.2; affected >= 2025.12.0-latest, < 2025.12.1; affected >= 2026.1.0-latest, < 2026.1.0

CWE

CWE-918

References

https://github.com/discourse/discourse/security/advisories/GHSA-gcfp-rjfc-925c

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.