Vulnerability · Published Sep 29, 2025 · Assigned by GitHub_M

CVE-2025-54592FreshRSS has Incomplete Session Termination on Logout

High 8.8

In plain English

A high-severity security flaw in FreshRSS from FreshRSS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.5%top 55.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0

Affected products (as reported)

Vendor	Product	Versions
FreshRSS	FreshRSS	< 1.27.0

Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

References

https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgr x_refsource_CONFIRM
https://github.com/FreshRSS/FreshRSS/pull/7762 x_refsource_MISC
https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0 x_refsource_MISC