Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-62166 Authentication Bypass in FreshRSS Before 1.28.0 Enabling Unauthorized Feed Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-62166
Post summary
A new authentication bypass vulnerability (CVE‑2025‑62166) exists in FreshRSS versions before 1.28.0, allowing unauthorized access to feeds.
CVE-2025-62166 FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually… https://www.cve.org/CVERecord?id=CVE-2025-62166
Post summary
A CVE‑2025‑62166 vulnerability in FreshRSS enables bypass of master authentication tokens in versions prior to 1.28.0, representing an auth bypass flaw.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | freshrss | freshrss | - | - | - |