VULNERABILITY INTELLIGENCE

CVE-2025-54592

CVSS score9.8 CRITICAL
EPSS probability0.53%
CISA KEVNot currently listed
Published2025-09-29
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0

Weakness classification

  • security-advisories@github.com: CWE-613

Primary references