CVE-2025-54592 - CVE House
Back to Database
Status published High CVE-2025-54592

FreshRSS has Incomplete Session Termination on Logout

Vulnerability Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54592

Credits & Attribution

No credits recorded in the NVD database.

References

More from FreshRSS

View All →
CVE-2025-68932
FreshRSS has weak cryptographic randomness in remember-me token and nonce generation
Low 2.9
CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]
High 8.2
CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After
Medium 4.3
CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
High 7.5
CVE-2025-61586
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Medium 6.9

Affected Vendor

Affected Software

FreshRSS
Vulnerable Versions:
< 1.27.0

Timeline

Official Publish: September 29th, 2025
Last Modified: September 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-613

MITRE ATT&CK TTPs

T1539 Steal Web Session Cookie
Credential Access
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1021 Remote Services
Lateral Movement
T1562 Impair Defenses
Defense Evasion