VYPR
← All advisories
High severity7.6OSV Advisory· Published Jan 28, 2026· Updated Jun 17, 2026

CVE-2025-68662

CVE-2025-68662

Description

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Discourse (software)/DiscourseOSV5 versions
    beta, latest-release, release, …+ 4 more
    • (no CPE)range: beta, latest-release, release, …
    • cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*range: <3.5.4
    • cpe:2.3:a:discourse:discourse:2025.12.0:*:*:*:stable:*:*:*
    • cpe:2.3:a:discourse:discourse:2026.1.0:*:*:*:stable:*:*:*
    • (no CPE)range: <3.5.4, <2025.11.2, <2025.12.1, <2026.1.0
  • osv-coords
    pkg:bitnami/discourse
    Range: < 3.5.4

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.