Threats tagged 'ghsa-26cc-hxwv-8v3f'

Miniflux versions prior to 2.3.5 have a vulnerability that allows an authenticated user with a valid session to change their account password without providing the current password. This flaw enables attackers who have stolen session cookies or access to an unattended device to change the password via the updateSettings function, potentially locking out the legitimate user and taking over the account.