CVE-2025-68932
Critical
Description
FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are the sole credential for "keep me logged in" functionality. This issue has been patched in version 1.28.0.
SeverityCritical
CVSS9.8
Exploit probability—
ProductFreshrss
PublishedDec 27, 2025
First seenDec 27, 2025
Weakness typeCWE-338CWE-338
How to fix
Update
- freshrss freshrss1.28.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freshrss freshrss | v < 1.28.0 | 1.28.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.