Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
FreshRSS password verification fails due to incorrect nonce length
CVE-2025-68402
Summary
FreshRSS, an RSS aggregator, has a bug that can let users log in with incorrect passwords. This is because the way the program checks passwords was changed in a way that doesn't work correctly. To fix this, update to the latest version of FreshRSS, which is 1.27.2-dev.
Original title
FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed st...
Original description
FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt’s 72-byte input truncation, this causes password verification to succeed even when the user enters an incorrect password. This vulnerability is fixed in 1.27.2-dev (476e57b). The issue was only present in the edge branch and never in a stable release.
nvd CVSS4.0
8.2
Vulnerability type
CWE-287
Improper Authentication
Published: 9 Mar 2026 · Updated: 13 Mar 2026 · First seen: 9 Mar 2026