CVE-2025-68148
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, an attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on a given instance, making it unusable for the majority of users. This issue has been patched in version 1.28.0.
Risk Assessment
The risk involves potential remote denial of service for all users, which could lead to service disruptions and loss of trust.
Recommendation
It is recommended to update FreshRSS to version 1.28.0 or later immediately and monitor proxy configuration.
Other vulnerabilities in FreshRSS
See all- CVE-2025-68402High
FreshRSS, a free self-hostable RSS aggregator, contains a vulnerability in development versions (from 57e1a37 to 00f2f04) where the nonce length was changed from 40 to 64 characters. password_verify() is called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt's 72-byte input truncation, password verification may succeed even when the user enters an incorrect password.
- CVE-2025-68932Critical
FreshRSS prior to version 1.28.0 uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking.
- CVE-2025-59949Medium
FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.
Original NVD description (English source)
FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS