CVE-2025-68932 - CVE House
Back to Database
Status published Low CVE-2025-68932

FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

Vulnerability Description

FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are the sole credential for "keep me logged in" functionality. This issue has been patched in version 1.28.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68932

Credits & Attribution

No credits recorded in the NVD database.

References

More from FreshRSS

View All →
CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]
High 8.2
CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After
Medium 4.3
CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
High 7.5
CVE-2025-61586
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Medium 6.9
CVE-2025-59950
FreshRSS: Double clickjacking can lead to privilege escalation
Medium 6.7

Affected Vendor

Affected Software

FreshRSS
Vulnerable Versions:
< 1.28.0

Timeline

Official Publish: December 26th, 2025
Last Modified: December 29th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-338

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.