CVE-2025-54592

CriticalCVSS 9.8/10Last modified Oct 19, 2026

Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
FreshRSS	FreshRSS	< 1.27.0

References

https://github.com/FreshRSS/FreshRSS/pull/7762Patch
https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0Release Notes
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgrExploit, Vendor Advisory
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgrExploit, Vendor Advisory

Timeline

Published: Sep 29, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-545937.2FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary co CVE-2025-545949.1react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-cana CVE-2025-545957.3Pearcleaner is a free, source-available and fair-code licensed mac app cleaner. The PearcleanerHelper is a privileged helper tool bundled wi CVE-2025-545964.3Abnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025-02-19 allows downgrading the privileges of other user accounts.CVE-2025-545976.1LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.CVE-2025-545986.5The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via CVE-2025-545997.5The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, whe CVE-2025-546017.0An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor amd Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480 CVE-2025-546027.0An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480 CVE-2025-546039.0An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation CVE-2025-546047.5Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2).CVE-2025-546057.5Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2).