Critical · published September 30, 2025
⚡ A session cookie that just won’t budge! Even after logging out of FreshRSS, your session cookie stays alive and kicking, making it deceptively easy for attackers to pounce. 🔥 Think of it like leaving your front door wide open after you’ve checked out of a hotel. Just because you’ve left doesn’t mean someone else can’t waltz right back in and take a look around! An attacker could exploit this vulnerability to hijack an active session, allowing them to access your RSS feeds, change settings, or even impersonate you! This could be absolutely devastating for your online privacy and security, especially if sensitive information is involved.
Think of it like leaving your front door wide open after you’ve checked out of a hotel. Just because you’ve left doesn’t mean someone else can’t waltz right back in and take a look around! FreshRSS versions 1.26.3 and below do not invalidate the session cookie upon logout, allowing a malicious actor to reuse it in a new session, which can lead to session hijacking and fixation attacks.
An attacker could exploit this vulnerability to hijack an active session, allowing them to access your RSS feeds, change settings, or even impersonate you! This could be absolutely devastating for your online privacy and security, especially if sensitive information is involved. Upgrade FreshRSS to version 1.27.0 immediately to ensure that session termination works as intended. Also, consider reviewing your overall authentication and session management practices to further enhance security. You've got this! Implement these changes, and you’ll be on your way to securing your RSS feeds in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| freshrss/freshrss | < 1.27.0 | 1.27.0 |