FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are the sole credential for "keep me logged in" functionality. This issue has been patched in version 1.28.0.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/FreshRSS/FreshRSS/commit/57e1a375cbd2db9741ff19167813344f8eff5772 Patch
- https://github.com/FreshRSS/FreshRSS/pull/8061 Issue Tracking, Patch
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786 Exploit, Patch, Vendor Advisory
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786 Exploit, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 2.9 · freshrssNVD modified 2026-10-13 09:10
Affected (CPE criteria) 1
cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*
References 4
- https://github.com/FreshRSS/FreshRSS/commit/57e1a375cbd2db9741ff19167813344f8eff5772 Patch
- https://github.com/FreshRSS/FreshRSS/pull/8061 Issue Tracking, Patch
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786 Exploit, Patch, Vendor Advisory
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786 Exploit, Patch, Vendor Advisory