CVE-2025-68402

FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt’s 72-byte input truncation, this causes password verification to succeed even when the user enters an incorrect password. This vulnerability is fixed in 1.27.2-dev (476e57b). The issue was only present in the edge branch and never in a stable release.

• CWE-287

• https://github.com/FreshRSS/FreshRSS/commit/476e57b04646416e24e24c56133c9fadf9e52b95
• https://github.com/FreshRSS/FreshRSS/pull/8061
• https://github.com/FreshRSS/FreshRSS/pull/8320
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-pcq9-mq6m-mvmp

Published

Mar 9, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68390Allocation of Resources Without Limits or Throttling (CWE-77…4.9
• CVE-2025-68398Weblate is a web based localization tool. In versions prior …9.1
• CVE-2025-68399ChurchCRM is an open-source church management system. In ver…5.4
• CVE-2025-6840A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-68400ChurchCRM is an open-source church management system. A SQL …8.8
• CVE-2025-68401ChurchCRM is an open-source church management system. Prior …4.8
• CVE-2025-68406A path traversal vulnerability has been reported to affect Q…6.5
• CVE-2025-6841A vulnerability has been found in code-projects Product Inve…7.2
• CVE-2025-6842A vulnerability was found in code-projects Product Inventory…7.2
• CVE-2025-68420Comarch ERP Optima client connects to a database using a hig…7.5
• CVE-2025-68421Comarch ERP Optima client makes use of a hard-coded password…8.7
• CVE-2025-68422Improper Authorization (CWE-285) in Kibana can lead to privi…4.3