CVE-2026-128330: Miniflux before 2.3.5 Insufficient Session Expiration After Password Change
Published Nov 13, 2026
·Updated
Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.
Affected Software
1 affected component
Miniflux Miniflux<2.3.5
Event History
Nov 13, 2026
CVE Published
via MITRE·09:33 AM
Data Sourced
via MITRE·09:33 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:18 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Miniflux versions before 2.3.5 are affected. Version 2.3.5 is the stated fixed boundary.
2
What would an attacker need to retain access?
The attacker must already hold a leaked password or a copied session cookie. They can retain access through an existing web session for up to 30 days after the password is changed.
3
What can a retained session allow an attacker to do?
A retained session can be used to read integration credentials, create API keys, or register passkeys.