CVE-2025-68932 is a critical vulnerability affecting FreshRSS, a self-hostable RSS aggregator, prior to version 1.28.0. The flaw stems from the use of cryptographically weak random number generators for remember-me tokens and nonces, enabling attackers to predict valid session tokens. This allows for persistent session hijacking and subsequent account takeover, as these tokens provide permanent authentication. Rated with a CVSS score of 9.8 (CRITICAL), this vulnerability has a low attack complexity and requires no user interaction, allowing for full compromise of confidentiality, integrity, and availability. The FAUCET Risk Score is 96/100, indicating a high potential for impact. While there is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and it is not listed in the KEV catalog, the vulnerability has garnered significant community discussion with 10 mentions, placing it in the top 1% of all CVEs for community attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.28.0CPE matchmatch criteria | cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.