CVE-2026-128330 · Package
NO FIX YET · SEE WHAT TO DO
Miniflux, a self-hosted feed reader, does not end existing web sessions when a user changes their password. An attacker who holds a leaked password or a copied session cookie keeps account access for up to 30 days, and can read integration credentials, create API keys or register passkeys.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run a self-hosted Miniflux instance before 2.3.5 with user accounts. Exposure depends on a stolen password or session cookie existing, so a compromised session is the trigger. Hosted or managed Miniflux instances are handled by their operator.
Not affected if managed-hosting, version-2.3.5-or-later
Who cares miniflux, self-hosted
miniflux -version or the version shown in the admin settings; versions before 2.3.5 are affected.2.3.5 or later.Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.