CVE-2026-128330

EUVD-2026-125047
Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.2 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.55%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
miniflux_projectminiflux
𝑥
< 2.3.5
CNA
Common Weakness Enumeration
References
https://github.com/miniflux/v2/blob/v2.3.4/internal/storage/user.go#L174-L190
https://github.com/miniflux/v2/commit/229035a4df6e60107d1117eb50696b23e08cb4b8
https://github.com/miniflux/v2/pull/4594
https://github.com/miniflux/v2/releases/tag/v2.3.5
https://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8
https://www.vulncheck.com/advisories/miniflux-before-2.3.5-insufficient-session-expiration-after-password-change