CVE-2026-94456
CriticalCVSS 9.1Summary
Postiz generates security-sensitive credentials using Math.random() instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8's deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state and derive past and future values.
Risk Assessment
An attacker can reconstruct the PRNG state and predict credentials belonging to other users and organizations, leading to account takeover and unauthorized access to resources.
Recommendation
Update Postiz to a version that uses a cryptographically secure random source for credential generation, and revoke and regenerate all existing tokens, secrets, and API keys.
Other vulnerabilities in Postiz
See all- CVE-2026-19264Critical
Postiz, an open-source social media scheduling tool, has a path traversal vulnerability in the route serving locally stored media. The route requires no authentication and does not normalize paths, allowing an unauthenticated attacker to read any file readable by the process, including environment variables with JWT secrets and database credentials.
- CVE-2026-48781Critical
Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, an attacker could exploit a vulnerability in the Skool integration to forge a SUPERADMIN session, allowing impersonation of arbitrary organizations.
- CVE-2026-42298Critical
Postiz, an AI social media scheduling tool, prior to commit da44801 contains a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow. Any unauthenticated user can execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions) by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev.
- CVE-2026-48799High
A vulnerability in Postiz, an AI social media scheduling tool, allows a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. The issue stems from missing verification of Nowpayments IPN callback authenticity and reading the subscription identifier from an untrusted request body.
- CVE-2026-48783Medium
Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects without verifying the token's intended purpose.
- CVE-2026-42556High
Postiz from version 2.21.6 to before 2.21.7 allows any authenticated user who can create a post to store arbitrary HTML in post content. The public preview link renders that HTML with dangerouslySetInnerHTML on the main application origin.
- CVE-2026-42346Medium
Postiz is an AI social media scheduling tool. In versions from 2.16.6 to 2.21.6, SSRF protections have a TOCTOU vulnerability: the isSafePublicHttpsUrl() function resolves DNS to validate the IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.
- CVE-2026-34590Medium
Postiz prior to version 2.21.4 has a blind SSRF vulnerability in the POST /webhooks/ endpoint. URL validation does not block internal/private addresses, allowing attackers to make requests to internal services.
- CVE-2026-34577High
Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('mp4'), which is trivially bypassable by appending .mp4 as a query parameter value or URL fragment. The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker to read responses from internal services, cloud metadata endpoints, and other network-internal resources.
- CVE-2026-34576High
Postiz before version 2.21.3 in the POST /public/v1/upload-from-url endpoint fetches user-supplied URLs without SSRF protections. File extension validation is easily bypassed. An authenticated user can read internal network resources and cloud metadata.
Original NVD description (English source)
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.