Critical · published December 27, 2025
⚠️ A little randomness can lead to big trouble! FreshRSS, prior to version 1.28.0, relied on weak random number generators for session tokens—like using a flimsy lock on your front door! 🔓 Think of it like a restaurant giving out numbered tickets to patrons, but the numbers are just the last two digits of the diner’s phone number. If someone knows how the system works, they can simply guess the ticket numbers and walk right in! Attackers could potentially predict valid session tokens, leading to account takeover through persistent session hijacking. While the risk is categorized as low, the thought of someone else accessing your account without permission is absolutely unsettling!
Think of it like a restaurant giving out numbered tickets to patrons, but the numbers are just the last two digits of the diner’s phone number. If someone knows how the system works, they can simply guess the ticket numbers and walk right in! FreshRSS used the mt_rand() and uniqid() functions to generate authentication tokens, which are not cryptographically secure. This predictability allows malicious users to forge a valid session token and gain unauthorized access.
Attackers could potentially predict valid session tokens, leading to account takeover through persistent session hijacking. While the risk is categorized as low, the thought of someone else accessing your account without permission is absolutely unsettling! Upgrade FreshRSS to version 1.28.0 or later to patch this vulnerability. It’s also a good idea to review your security policies regarding session management and consider using stronger random number generators for token creation. 🛡️ This is fixable! Stay vigilant and keep your software up to date to maintain that security hero status! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| freshrss/freshrss | < 1.28.0 | 1.28.0 |