Platform
php
Component
freshrss
Fixed in
476.0.1
FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt’s 72-byte input truncation, this causes password verification to succeed even when the user enters an incorrect password. This vulnerability is fixed in 1.27.2-dev (476e57b). The issue was only present in the edge branch and never in a stable release.
Exploit Status
EPSS
0.05% (17% percentile)
CISA SSVC
Update FreshRSS to version 1.27.2-dev (commit 476e57b) or later. This version fixes the authentication bypass vulnerability caused by the bcrypt hash truncation. Updating ensures that password verification is performed correctly and unauthorized access is prevented.
Vulnerability analysis and critical alerts directly to your inbox.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.