CVE-2026-128330
Deferred Deferred - Pending Action

Insufficient Session Expiration in Miniflux

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128330
EUVD
EUVD-2026-125047

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
miniflux miniflux From 0 (inc) to 2.3.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Miniflux before version 2.3.5 has a session management flaw where changing a user's password does not invalidate existing active sessions. This allows attackers with a leaked password or copied session cookie to maintain unauthorized access for up to 30 days, potentially compromising account data and credentials.

Detection Guidance

To detect this vulnerability, check for active sessions in Miniflux that exceed the expected session duration after a password change. Review session logs or database entries for sessions older than 30 days. No specific commands are provided in the context.

Impact Analysis

If you use Miniflux before 2.3.5, an attacker could access your account even after you change your password. They might read sensitive data, create API keys, or register passkeys, leading to data breaches or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance penalties due to prolonged exposure of user data.

Mitigation Strategies

Immediately update Miniflux to version 2.3.5 or later to address the session expiration issue. After updating, force all users to log out and reset passwords to invalidate existing sessions. Review and revoke any suspicious API keys or passkeys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128330. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...