CVE-2025-68402 - CVE House

Back to Database

Status published High CVE-2025-68402

FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]

8.2 CVSS

Vulnerability Description

FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt’s 72-byte input truncation, this causes password verification to succeed even when the user enters an incorrect password. This vulnerability is fixed in 1.27.2-dev (476e57b). The issue was only present in the edge branch and never in a stable release.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68402

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from FreshRSS

View All →

FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After

FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens

FreshRSS is vulnerable to directory enumeration by setting path in its theme field

FreshRSS: Double clickjacking can lead to privilege escalation

Affected Vendor

FreshRSS

View all reports →

Affected Software

FreshRSS

Vulnerable Versions:

< 476e57b04646416e24e24c56133c9fadf9e52b95

Timeline

Official Publish: March 9th, 2026

Last Modified: March 9th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1556 Modify Authentication Process

Credential Access