Threats affecting pkg:golang/miniflux

Miniflux versions prior to 2.3.5 have a vulnerability where session expiration is insufficient. Password changes do not invalidate existing web sessions, allowing attackers with leaked passwords or session cookies to maintain access for up to 30 days. This access can be used to read integration credentials, create API keys, or register passkeys.

Miniflux versions prior to 2.3.5 have a vulnerability that allows an authenticated user with a valid session to change their account password without providing the current password. This flaw enables attackers who have stolen session cookies or access to unattended devices to hijack accounts by locking out the legitimate owner. The issue is fixed in version 2.3.5.