CVE-2025-46341

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the "Remote-User" header or the "X-WebAuth-User" header by making specially crafted requests via the add feed functionalit...