PT-2026-24102 · Freshrss · Freshrss

Published 2026-03-09 · Updated 2026-03-10 · CVE-2025-68402

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreshRSS versions prior to 1.27.2-dev

Description FreshRSS, a self-hostable RSS aggregator, contains a flaw related to password verification. A change in the length of the nonce, from 40 to 64 characters (between commits 57e1a37 and 00f2f04), causes the password verify() function to be called with a constructed string instead of the raw user password. This constructed string consists of a SHA-256 nonce combined with a portion of a bcrypt hash. Due to bcrypt’s 72-byte input truncation, this allows password verification to succeed even with an incorrect password. The issue was present in the edge branch but not in stable releases.

Recommendations Update to version 1.27.2-dev or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-68402

GHSA-PCQ9-MQ6M-MVMP

Affected Products

Freshrss

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68402.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-68402 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68402 · Security Note
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-pcq9-mq6m-mvmp · Note
• https://github.com/FreshRSS/FreshRSS/pull/8320 · Note
• https://github.com/FreshRSS/FreshRSS/pull/8061 · Note
• https://github.com/FreshRSS/FreshRSS/commit/476e57b04646416e24e24c56133c9fadf9e52b95 · Note
• https://twitter.com/VulmonFeeds/status/2031161758627275126 · Twitter Post
• https://twitter.com/CVEnew/status/2031122519965512079 · Twitter Post