CVE-2025-68402

Katalog CVE

CVSS 8.2 · High EPSS 0,27%

Kerentanan Improper Authentication. Skor CVSS 4.0 8.2 (High) menurut github.com.

Deskripsi (NVD)

FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt’s 72-byte input truncation, this causes password verification to succeed even when the user enters an incorrect password. This vulnerability is fixed in 1.27.2-dev (476e57b). The issue was only present in the edge branch and never in a stable release.

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

8.2 (High), sumber github.com
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/FreshRSS/FreshRSS/commit/476e57b04646416e24e24c56133c9fadf9e52b95
• https://github.com/FreshRSS/FreshRSS/pull/8061
• https://github.com/FreshRSS/FreshRSS/pull/8320
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-pcq9-mq6m-mvmp