FreshRSS, a free self-hostable RSS aggregator, contains an authentication bypass vulnerability in versions prior to 1.28.0. The bug exists in the auth logic related to master authentication tokens, allowing the restriction to be bypassed. This vulnerability enables unauthorized access to private user feeds when anonymous viewing is enabled, when normally only the default user's feed should be viewable. The issue has been patched in version 1.28.0.