CVE-2026-128331 in Miniflux
Summary
by MITRE • 11/13/2026
Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The Miniflux application, prior to version 2.3.5, contains an authentication bypass vulnerability related to password modification functionality. This flaw stems from a failure in server-side validation logic where the system does not require proof of ownership for the current credentials when processing a request to update account settings and change passwords. Specifically, the endpoint responsible for updating user profile information accepts parameters for new password fields without verifying that the requester possesses the existing valid password or session token integrity beyond basic authentication state. This design oversight allows any actor who has obtained an active, signed-in session identifier to manipulate the account's security credentials directly through standard API calls such as updateSettings.
From a technical perspective, this vulnerability represents a classic case of insufficient verification of user intent and ownership during sensitive configuration changes. The application relies solely on the presence of a valid session cookie or token to authorize the password change operation, neglecting the critical step of requiring re-authentication for high-privilege actions like credential modification. This gap in access control logic means that if an attacker manages to acquire a legitimate user's active session identifier through methods such as cross-site scripting attacks, network interception on unencrypted connections, or physical theft of an unlocked device, they can immediately execute the password change routine without needing the original credentials.
The operational impact of this vulnerability is severe and directly leads to account takeover scenarios. An attacker who exploits this flaw can set a new password for the victim's Miniflux account, effectively locking out the legitimate owner from accessing their feed reader data. This action not only results in unauthorized access but also constitutes a denial-of-service condition for the user regarding their own account recovery mechanisms until they reset it via external email verification or other administrative processes. The ability to silently change passwords without triggering immediate alerts based on credential mismatch makes this particularly dangerous, as the attacker gains persistent control over the compromised account while the victim may remain unaware of the breach until login attempts fail repeatedly.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-640 Weak Password Change Mechanism within the Common Weakness Enumeration framework. In terms of adversary tactics, it facilitates techniques associated with Account Manipulation under the MITRE ATT&CK framework, specifically allowing an attacker to maintain persistence or escalate privileges by securing control over a user identity after initial access has been gained through session hijacking. The lack of multi-factor verification for sensitive changes is a common pattern in legacy web applications that prioritizes convenience over security rigor during critical state transitions.
To mitigate this vulnerability, users must upgrade Miniflux to version 2.3.5 or later where the patch enforces proper validation checks before allowing password updates. Administrators should ensure that all instances are updated promptly as older versions remain exploitable by any party with session access. Additionally, implementing strict cookie security attributes such as HttpOnly and Secure flags can reduce the risk of initial session theft via cross-site scripting attacks. Enforcing multi-factor authentication where supported adds an additional layer of protection, ensuring that even if a password is changed maliciously, unauthorized login attempts from new devices or locations are blocked until secondary verification is completed. Regular security audits focusing on sensitive action authorization flows should be conducted to identify similar gaps in other application modules.