Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination…

CVE-2025-68662 affects the Discourse open source discussion platform in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. A hostname validation issue in the FinalDestination component allows attackers to bypass Server-Side Request Forgery (SSRF) protections under certain conditions. The vulnerability has been patched in the specified versions. No workarounds are available for this security issue. Organizations using affected versions should upgrade immediately to mitigate the SSRF bypass risk.