Authentication Bypass in FreshRSS RSS Aggregator

CVE-2025-62166

What is CVE-2025-62166?

FreshRSS, a self-hostable RSS aggregator, is affected by an authentication bypass vulnerability prior to version 1.28.0. This flaw occurs within the authentication logic related to master authentication tokens, allowing unauthorized access to user feeds. Normally, if anonymous viewing is enabled, only the default user’s feed should be accessible, while feeds from other users are meant to remain private. However, due to this vulnerability, it is possible to bypass these restrictions. The issue is addressed in version 1.28.0, making it essential for users to upgrade to this version to ensure their feed privacy.

References