Threats tagged 'ghsa-r8q8-f4rr-p77m'

Miniflux versions prior to 2.3.5 have a vulnerability where session expiration is insufficient. This flaw allows attackers who possess a leaked password or copied session cookie to maintain access to the account for up to 30 days, even after the password is changed. Persistent access enables reading integration credentials, creating API keys, or registering passkeys.