CVE-2025-54592: FreshRSS has Incomplete Session Termination on Logout
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54592?
CVE-2025-54592 has been rated as a high severity vulnerability due to session management issues.
How do I fix CVE-2025-54592?
To fix CVE-2025-54592, upgrade FreshRSS to version 1.27.0 or later.
What vulnerability does CVE-2025-54592 address?
CVE-2025-54592 addresses the failure to terminate session cookies properly after user logout.
What versions of FreshRSS are affected by CVE-2025-54592?
FreshRSS versions 1.26.3 and below are affected by CVE-2025-54592.
What is the impact of CVE-2025-54592?
The impact of CVE-2025-54592 could allow an attacker to reuse session cookies after a user has logged out.