CVE-2026-128330

Name of the Vulnerable Software and Affected Versions Miniflux versions prior to 2.3.5

Description Insufficient session expiration allows attackers to maintain account access because changing a password does not revoke active web sessions. An attacker with a leaked password or a copied session cookie can retain access for up to 30 days, enabling them to read integration credentials, create API keys, or register passkeys.

Recommendations Update to version 2.3.5 or later.