CVE-2025-54592 HIGH

CVE-2025-54592: FreshRSS has Incomplete Session Termination on Logout

Vendor Freshrss
Product FreshRSS
Weakness CWE-613 · Insufficient session expiration
Published September 29, 2025
Last update September 30, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0

Key dates

02Disclosure timeline

September 29, 2025 CVE published
September 30, 2025 Record updated