Description

FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt’s 72-byte input truncation, this causes password verification to succeed even when the user enters an incorrect password. This vulnerability is fixed in 1.27.2-dev (476e57b). The issue was only present in the edge branch and never in a stable release.

INFO

Published Date :

2026-03-09T19:41:57.974Z

Last Modified :

2026-03-09T20:44:25.146Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-68402 vulnerability.

Vendors Products
Freshrss
  • Freshrss
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-68402.

URL Resource
https://github.com/FreshRSS/FreshRSS/commit/476e57b04646416e24e24c56133c9fadf9e52b95 cve-icon cve-icon
https://github.com/FreshRSS/FreshRSS/pull/8061 cve-icon cve-icon
https://github.com/FreshRSS/FreshRSS/pull/8320 cve-icon cve-icon
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-pcq9-mq6m-mvmp cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability