CVE-2025-68932

Katalog CVE

CVSS 9.8 · Critical EPSS 0,63%

Kerentanan Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) pada freshrss. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are the sole credential for "keep me logged in" functionality. This issue has been patched in version 1.28.0.

Rincian

Terbit di NVD

27 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786 exploit · patch · advisory vendor
• https://github.com/FreshRSS/FreshRSS/commit/57e1a375cbd2db9741ff19167813344f8eff5772 patch
• https://github.com/FreshRSS/FreshRSS/pull/8061 issue tracking · patch