FreshRSS CVE-2025-68932

Exploitation requires that the victim actually uses the 'keep me logged in' (remember-me) functionality, since the predictable remember-me token is the sole persistent credential being attacked; it also applies to challenge-response nonces and email-validation tokens generated the same way. The affected tokens are built as sha1(systemConf->salt . username . uniqid('' . mt_rand(), true)), so successful prediction requires defeating the mt_rand()/uniqid() entropy AND knowing or recovering the secret per-instance system salt and the target username - these are the primary limiting factors and the reason for AC:H/AT:P. No authentication is required to attempt token prediction (PR:N) and no user interaction is needed (UI:N), and the weak generators are used by default, but all affected instances are those running versions prior to 1.28.0.

Signals converge on LOW real-world priority despite the alarming 'account takeover' language in the description. The vendor CVSS 4.0 score is only 2.9, with AC:H (high complexity) and AT:P (specific attack requirements) reflecting that predicting the tokens is non-trivial, and VC:L/VI:N/VA:N capping impact. Crucially, the patched code shows the token is sha1(systemConf->salt . username . uniqid(mt_rand)) - the weak mt_rand()/uniqid() entropy is the flaw, but the token is also mixed with a SECRET system salt, so prediction realistically requires recovering or knowing that salt, which is why complexity is high. EPSS is low at 0.55% (45th percentile) and this is NOT on CISA KEV, consistent with the low-priority picture. POC/exploit material is publicly available (the GHSA advisory), but POC availability is not active exploitation. Signals are internally consistent rather than conflicting: CVSS, EPSS, and absence of KEV all point the same direction. The main caveat is that CVSS rates CONFIDENTIALITY impact only as Low (VC:L) even though successful exploitation yields full persistent session takeover of the victim's account - an analyst may consider the per-account impact higher than the vector suggests, but exploitability remains the limiting factor.

A remote unauthenticated attacker targeting a FreshRSS instance where users rely on the 'keep me logged in' feature attempts to predict the remember-me token, which is derived from the weak mt_rand()/uniqid() PRNG. If the attacker can overcome the PRNG weakness and the secret system salt, they forge a valid persistent authentication cookie and hijack the victim's account. Public exploit/advisory material (GHSA-j9wc-gwc6-p786) exists, but the high attack complexity (AC:H) and dependency on the secret salt make practical exploitation difficult.