CVE-2026-128330

Miniflux before 2.3.5 Insufficient Session Expiration After Password Change

Published Nov 13, 2026 CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed

Description

Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.

Analysis

No analysis available yet

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

miniflux

unaffected

Version	Status	Constraints
`0`	affected	< 2.3.5

No data.

No data available yet.

Remediation

No remediation available yet

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/miniflux/v2/blob/v2.3.4/internal/storage/user.go#L174-L190
https://github.com/miniflux/v2/commit/229035a4df6e60107d1117eb50696b23e08cb4b8
https://github.com/miniflux/v2/pull/4594
https://github.com/miniflux/v2/releases/tag/v2.3.5
https://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8
https://www.vulncheck.com/advisories/miniflux-before-2.3.5-insufficient-session-expiration-after-password-change

History

Nov 13, 2026 9:45 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.
Title		Miniflux before 2.3.5 Insufficient Session Expiration After Password Change
First Time appeared		Miniflux Project Miniflux Project miniflux
Weaknesses		CWE-613
CPEs		cpe:2.3:a:miniflux_project:miniflux::::::::
Vendors & Products		Miniflux Project Miniflux Project miniflux
References		https://github.com/miniflux/v2/blob/v2.3.4/internal/storage/user.go#L174-L190 https://github.com/miniflux/v2/commit/229035a4df6e60107d1117eb50696b23e08cb4b8 https://github.com/miniflux/v2/pull/4594 https://github.com/miniflux/v2/releases/tag/v2.3.5 https://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8 https://www.vulncheck.com/advisories/miniflux-before-2.3.5-insufficient-session-expiration-after-password-change
Metrics		cvssV3_1 `{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}` cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`