CVE-2025-54592

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/FreshRSS/FreshRSS/pull/7762	Patch
https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0	Release Notes
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgr	Exploit Vendor Advisory
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgr	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) FreshRSS es un agregador RSS gratuito y autoalojable. Las versiones 1.26.3 e inferiores no terminan correctamente la sesión durante el cierre de sesión. Después de que un usuario cierra sesión, la cookie de sesión permanece activa e inalterada. La cookie inalterada podría ser reutilizada por un atacante si se iniciara una nueva sesión. Este fallo al invalidar la sesión puede conducir a vulnerabilidades de secuestro y fijación de sesión. Este problema está solucionado en la versión 1.27.0

Information

Published : 2025-09-29 22:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-54592

Mitre link : CVE-2025-54592

CVE.ORG link : CVE-2025-54592

JSON object : View

Products Affected

freshrss

freshrss

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-54592", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54592", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-30T13:32:36.755129Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FreshRSS", "product": "FreshRSS", "versions": [{"status": "affected", "version": "< 1.27.0"}]}]}], "published": "2025-09-29T22:15:36.160", "references": [{"url": "https://github.com/FreshRSS/FreshRSS/pull/7762", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgr", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgr", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0"}, {"lang": "es", "value": "FreshRSS es un agregador RSS gratuito y autoalojable. Las versiones 1.26.3 e inferiores no terminan correctamente la sesi\u00f3n durante el cierre de sesi\u00f3n. Despu\u00e9s de que un usuario cierra sesi\u00f3n, la cookie de sesi\u00f3n permanece activa e inalterada. La cookie inalterada podr\u00eda ser reutilizada por un atacante si se iniciara una nueva sesi\u00f3n. Este fallo al invalidar la sesi\u00f3n puede conducir a vulnerabilidades de secuestro y fijaci\u00f3n de sesi\u00f3n. Este problema est\u00e1 solucionado en la versi\u00f3n 1.27.0"}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5043EB51-EC2A-4735-A3E0-9E07DA94ECF7", "versionEndExcluding": "1.27.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}