CVE-2025-68932: 
NixOS vulnerability analysis and mitigation

CVE-2025-68932 is a weak cryptographic randomness vulnerability in FreshRSS, a free self-hostable RSS aggregator, affecting all versions prior to 1.28.0. The flaw involves the use of PHP's mt_rand() and uniqid() functions — both cryptographically insecure — to generate remember-me authentication tokens and challenge-response nonces, enabling attackers to predict valid session tokens and achieve account takeover. It was published on December 26, 2025, and patched in version 1.28.0 released December 24, 2025. The CVSS v3.1 base score is 9.8 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). Specifically, remember-me tokens were generated as sha1(salt . username . uniqid('' . mt_rand(), true)) in app/Models/FormAuth.php, and authentication nonces were similarly derived using mt_rand() and uniqid() in app/Controllers/javascriptController.php. The Mersenne Twister PRNG (mt_rand()) is not cryptographically secure and its internal state can be predicted after observing sufficient outputs; uniqid() relies on system microseconds providing only ~20 bits of entropy. SHA-1 hashing does not add entropy — it merely distributes the existing weak randomness — resulting in effective token entropy of only ~40–71 bits, well below the 128+ bits required for secure session tokens. Tokens are stored as flat files at DATA_PATH/tokens/{token}.txt with no rate limiting on validation attempts, further lowering the bar for brute-force attacks (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to predict valid remember-me session tokens and hijack persistent user sessions, resulting in complete account takeover. Because remember-me tokens serve as the sole credential for the "keep me logged in" functionality and can persist for up to 30 days by default, a compromised token grants long-term unauthorized access to the victim's RSS feeds, account settings, and any data stored within the FreshRSS instance. The confidentiality, integrity, and availability of the affected account are all fully compromised (GitHub Advisory).

A proof-of-concept exploitation methodology is publicly documented in the GitHub Security Advisory, including use of php_mt_seed for Mersenne Twister state prediction and timing synchronization to narrow uniqid() microsecond values. Exploitation complexity is rated HIGH by the advisory author, as it requires knowledge of the system salt, the target username, cryptanalysis capability, and timing synchronization with the server. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is 0.06% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a publicly accessible FreshRSS instance running a version prior to 1.28.0. Confirm the target username (often public or guessable).
2. Obtain or estimate the system salt: The salt may leak through timing attacks, misconfigured file permissions, or other vulnerabilities exposing config.php.
3. Capture a reference token: Enable "Remember me" on a controlled account and capture the FreshRSS_login cookie value to observe token format and timing.
4. Predict PRNG state: Use tools such as php_mt_seed to reconstruct the Mersenne Twister internal state from observed token outputs, enabling prediction of future mt_rand() values.
5. Synchronize timing: Correlate server request timestamps to narrow the microsecond window used by uniqid(), reducing the candidate token space.
6. Generate candidate tokens: Compute candidate tokens using the predicted mt_rand() values, estimated microsecond timestamps, known salt, and target username: sha1(salt . username . uniqid('' . mt_rand(), true)).
7. Probe for valid tokens: Submit candidate tokens as the FreshRSS_login cookie value via HTTP requests (e.g., curl -b "FreshRSS_login=PREDICTED_TOKEN" https://target.com/) until a valid session is obtained.
8. Achieve persistent access: A successfully predicted token grants full account access for up to 30 days without requiring the user's password (GitHub Advisory).

• Network: Rapid or repeated HTTP requests to the FreshRSS login endpoint with varying FreshRSS_login cookie values from a single IP or small IP range, suggesting token brute-forcing or probing.
• Logs: Web server access logs showing many 200 OK or 302 responses to authenticated pages using cookie-based authentication without a preceding form-based login; unusual access patterns from unfamiliar IP addresses.
• File System: Unexpected access timestamps on token files located at DATA_PATH/tokens/*.txt; a high volume of token files being read in a short time window.
• Application Behavior: User sessions appearing active from geographic locations or user agents inconsistent with the legitimate account owner's normal behavior (GitHub Advisory).

Upgrade FreshRSS to version 1.28.0 or later, which replaces all uses of mt_rand()/uniqid() with PHP's random_bytes(32) and hash('sha256', ...) for cryptographically secure token and nonce generation. No configuration-based workaround is available for the underlying PRNG weakness; upgrading is the only effective remediation. As an interim measure, administrators can disable the "Remember me" functionality or enforce shorter session durations to reduce the window of exposure for any existing weak tokens. After upgrading, invalidate all existing remember-me tokens by clearing the DATA_PATH/tokens/ directory (Patch Commit, GitHub PR).

The vulnerability was reported by community researcher hackerman70000 and patched by FreshRSS maintainer Alkarex in PR #8061, merged October 4, 2025, as part of the 1.28.0 milestone. A Medium article titled "Breaking Down a Broken Authentication Design in FreshRSS" provided public analysis of the flaw. A PentesterLab blog post was also referenced in the GitHub PR discussion, which prompted a detailed response from Alkarex defending the original challenge-response design as intentional for non-HTTPS deployments and criticizing the lack of community contributions to test coverage. The maintainer expressed frustration that security advisories often arrive without accompanying patches or tests, noting the complexity of testing FreshRSS's authentication flow (GitHub PR, GitHub Advisory).