CVE-2025-68932

LOW EPSS 38.9%
Published Dec 27, 20256mo ago · Modified Jun 17, 20262w ago
2.9 CVSS 4.0
Low
Find Similar
Published Dec 27, 2025 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are the sole credential for "keep me logged in" functionality. This issue has been patched in version 1.28.0.

CVSS Details

Base Score
2.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
38.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-338

Affected Products 1

VendorProductVersionRange
freshrssfreshrss* <1.28.0

References 3

  • github.com https://github.com/FreshRSS/FreshRSS/commit/57e1a375cbd2db9741ff19167813344f8eff5772
    Patch
  • github.com https://github.com/FreshRSS/FreshRSS/pull/8061
    Issue TrackingPatch
  • github.com https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786
    ExploitPatchVendor Advisory

Remediation

  • github.com https://github.com/FreshRSS/FreshRSS/commit/57e1a375cbd2db9741ff19167813344f8eff5772
    Patch
  • github.com https://github.com/FreshRSS/FreshRSS/pull/8061
    Issue TrackingPatch
  • github.com https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786
    ExploitPatchVendor Advisory