CVE-2026-128330

MEDIUM 4.2

Miniflux before 2.3.5 Insufficient Session Expiration After Password Change

CVSS Score

4.2

EPSS Score

0.0%

EPSS Percentile

0th

Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.

CWE	CWE-613
Vendor	miniflux
Product	miniflux
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for miniflux miniflux

Be the first to know when new medium vulnerabilities affecting miniflux miniflux are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

miniflux / miniflux

0 < 2.3.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8 github.com: https://github.com/miniflux/v2/commit/229035a4df6e60107d1117eb50696b23e08cb4b8 github.com: https://github.com/miniflux/v2/pull/4594 github.com: https://github.com/miniflux/v2/releases/tag/v2.3.5 github.com: https://github.com/miniflux/v2/blob/v2.3.4/internal/storage/user.go#L174-L190 vulncheck.com: https://www.vulncheck.com/advisories/miniflux-before-2.3.5-insufficient-session-expiration-after-password-change

Credits

Sandipkumar sah Frédéric Guillot