CVE-2025-54592 is a critical (CVSS 9.8) session management flaw in FreshRSS, the self hosted RSS reader. Logging out did not terminate the session, so the cookie stayed active and could be reused. Versions 1.26.3 and below are affected; 1.27.0 fixes it.
What's affected
- FreshRSS 1.26.3 and below is affected.
- Fixed in FreshRSS 1.27.0.
The record lists CVSS 9.8 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Open the About page in FreshRSS to read the version, or check your container image tag.
docker image ls freshrss/freshrss
Anything at 1.26.3 or below needs the upgrade.
What to do now
- Upgrade FreshRSS to 1.27.0 or later.
- Put the instance behind HTTPS if it is not already.
- Avoid using shared or public computers to sign in until you have upgraded.
- Consider changing your password after upgrading if you used shared devices.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-613, insufficient session expiration. The server did not invalidate the session on logout, so a captured cookie kept working. The record notes this can lead to hijacking and fixation.
The 9.8 score reflects the maximum impact if an attacker holds a valid session of an administrator. In practice, exposure needs a stolen or reused cookie, which is a step beyond the flaw itself.
Severity scores are a starting point. The score for this entry is 9.8, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Does logging out protect me before the upgrade?
Not fully. The record says the cookie stays active after logout.
Is the fix a version bump only?
The advisory names 1.27.0. Read the release notes for any related changes.
Sources
- https://github.com/FreshRSS/FreshRSS/pull/7762
- https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgr
Last reviewed: 18 October 2026.
