Authentication Bypass Vulnerability in FreshRSS by FreshRSS

CVE-2025-68402

What is CVE-2025-68402?

FreshRSS, a self-hostable RSS aggregator, contains a significant security flaw in its edge branch. The vulnerability arises from a change in the nonce length from 40 characters to 64, which affects how passwords are verified. Specifically, the use of password_verify() with a constructed string (SHA-256 nonce combined with part of a bcrypt hash) leads to incorrect password verifications, allowing unauthorized access even when a wrong password is entered. This issue was identified in versions between 57e1a37 and 00f2f04 and has been patched in version 1.27.2-dev (commit 476e57b) to restore proper authentication mechanisms.

References