PT-2025-53609 · Freshrss · Freshrss

Hackerman70000 · Published 2025-12-26 · Updated 2026-01-01 · CVE-2025-68932

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreshRSS versions prior to 1.28.0

Description FreshRSS utilizes weak random number generators (mt rand() and uniqid()) for creating remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, potentially leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are used for the "keep me logged in" feature.

Recommendations Update to version 1.28.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2025-68932

GHSA-J9WC-GWC6-P786

Affected Products

Freshrss

References · 12

• 🔥 https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68932.json · Exploit
• https://github.com/FreshRSS/FreshRSS/pull/8061 · Patch
• https://github.com/FreshRSS/FreshRSS/commit/57e1a375cbd2db9741ff19167813344f8eff5772 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-68932 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68932 · Vendor Advisory
• https://t.me/cveNotify/146927 · Telegram Post
• https://twitter.com/cracbot/status/2006681851382084003 · Twitter Post
• https://t.me/CVEtracker/40736 · Telegram Post
• https://t.me/cveNotify/147405 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2004712189106483275 · Twitter Post
• https://twitter.com/CVEnew/status/2004868110340514039 · Twitter Post