CVE-2025-68402

FreshRSS authentication issue affecting the edge branch (from commit range 57e1a37–00f2f04). The nonce length was increased from 40 to 64, and password_verify() is called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt’s 72-byte in...