CVE-2025-68402 Details
Description
FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt’s 72-byte input truncation, this causes password verification to succeed even when the user enters an incorrect password. This vulnerability is fixed in 1.27.2-dev (476e57b). The issue was only present in the edge branch and never in a stable release.
An authentication bypass vulnerability has been identified in FreshRSS, a self-hosted RSS aggregator, specifically in the edge branch versions 1.27.2-dev (57e1a37 - 00f2f04). The issue arises from a change in nonce length, which was increased from 40 to 64 characters. This modification led to the improper construction of the string used in the password verification process. The 'password_verify()' function was called with a concatenated string of the SHA-256 nonce and a portion of the bcrypt hash, rather than the raw user password. Bcrypt truncates input longer than 72 bytes, causing the verification to incorrectly succeed even when an incorrect password is provided. This vulnerability allows users to log in without the correct credentials.
Users can update to FreshRSS version 1.27.2-dev (476e57b) to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 9, 2026CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreshRSS/FreshRSS/commit/476e57b04646416e24e24c56133c9fadf9e52b95 | [email protected] | Source CodeVendor |
| https://github.com/FreshRSS/FreshRSS/pull/8061 | [email protected] | Source CodeVendor |
| https://github.com/FreshRSS/FreshRSS/pull/8320 | [email protected] | Source CodeVendor |
| https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-pcq9-mq6m-mvmp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FreshRSS | >= 1.27.2-dev, <= 1.27.2-dev (57e1a37 - 00f2f04) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 9, 2026 | New CVE Received | [email protected] |