QwikSec

Security Database

CVE

CWE

Training

CVE-2025-54592

Published: Sep 29, 2025

Modified: Sep 30, 2025

PUBLISHED

Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0

Vendor	Product	Versions
FreshRSS	FreshRSS	affected `< 1.27.0`

Weaknesses (CWE)

References

https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgr

x_refsource_CONFIRM

https://github.com/FreshRSS/FreshRSS/pull/7762

x_refsource_MISC

https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.