CVE-2026-94456 (GCVE-0-2026-94456)
Vulnerability from cvelistv5 – Published: 2026-09-22 16:11 – Updated: 2026-09-22 18:11
VLAI
EPSS
VEX
Title
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
Summary
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state.
An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 18:10 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/gitroomhq/postiz-app | product |
| https://github.com/gitroomhq/postiz-app/releases/… | release-notes |
| https://github.com/gitroomhq/postiz-app/commit/92… | patch |
| https://gadvisory.org/advisories/PSA-2026-TD98KY | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| GitroomHQ | postiz-app |
Affected:
0 , < 2.4.0
(semver)
|
guessed |
Date Public
2026-09-22 14:17
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:10:57.774548Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:11:17.502Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "postiz-app",
"product": "postiz-app",
"repo": "https://github.com/gitroomhq/postiz-app",
"vendor": "GitroomHQ",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All deployments running the released code up to and including v2.23.0 are affected, self-hosted and hosted alike. The identifier helper is shared code reached by every credential-minting path, and there is no feature flag, environment variable or build option that selects a different random source."
},
{
"lang": "en",
"value": "The anonymous sampling surface, the OAuth dynamic client registration endpoint, is registered in both the default controller set and the MCP_ONLY controller set, so it is reachable in either deployment mode."
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Santosh Kumar Puppala"
},
{
"lang": "en",
"type": "coordinator",
"value": "Enno Gelhaus"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nevo David"
}
],
"datePublic": "2026-09-22T14:17:43.125Z",
"descriptions": [
{
"lang": "en",
"value": "Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8\u2019s deterministic xorshift128+ PRNG state.\n\nAn unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations."
}
],
"exploits": [
{
"lang": "en",
"value": "No public exploit code is known. The original submission was methodology-only and deliberately omitted a working implementation."
}
],
"impacts": [
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker who predicts an OAuth access token minted for another organization is authenticated as that organization with SUPERADMIN rights over the public API, giving full read and write access to its scheduled posts, connected social accounts, media and team membership."
}
]
},
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "The per-organization API key generated at registration is drawn from the same generator and is honoured by the same middleware with the same SUPERADMIN grant, so an attacker sampling the generator around a signup can predict the API key of a newly created organization."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "OAuth client secrets, including those returned by anonymous dynamic client registration and by secret rotation, are predictable, allowing an attacker to impersonate a registered OAuth or MCP client to the token endpoint."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Authorization codes issued at the consent step are predictable, exposing in-flight OAuth authorization flows to interception and redemption by a third party."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "PKCE code verifiers generated for social account connections are predictable, removing the protection PKCE is present to provide for those provider flows."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-330",
"description": "CWE-330",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-341",
"description": "CWE-341",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T16:16:23.351Z",
"orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"shortName": "postiz"
},
"references": [
{
"name": "Postiz",
"tags": [
"product"
],
"url": "https://github.com/gitroomhq/postiz-app"
},
{
"name": "v2.24.0",
"tags": [
"release-notes"
],
"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.24.0"
},
{
"name": "9259cf24",
"tags": [
"patch"
],
"url": "https://github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d7ffba63"
},
{
"name": "GAdvisory",
"tags": [
"vendor-advisory"
],
"url": "https://gadvisory.org/advisories/PSA-2026-TD98KY"
}
],
"solutions": [
{
"lang": "en",
"value": "Run a Postiz release in which security-sensitive identifiers are generated from a cryptographically secure random source rather than from Math.random(). No fixed release is available at the time of writing; this advisory will record the fixed version once one is published."
},
{
"lang": "en",
"value": "Once running a release with a corrected generator, treat every credential issued by an affected version as compromised and replace it. That covers organization API keys, OAuth application client secrets, and any outstanding OAuth access tokens and authorizations. Outstanding authorization codes are short-lived and expire on their own."
},
{
"lang": "en",
"value": "Operators who connected social accounts while running an affected version should review those connections, since the PKCE verifiers used to establish them were drawn from the same generator."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T13:34:00.000Z",
"value": "Postiz has received and acknowledged the report."
},
{
"lang": "en",
"time": "2026-09-21T20:15:00.000Z",
"value": "Postiz has verified the report."
},
{
"lang": "en",
"time": "2026-09-22T04:32:00.000Z",
"value": "Postiz has developed and verified the patch."
},
{
"lang": "en",
"time": "2026-09-22T14:17:00.000Z",
"value": "Postiz has released the patch notes and published the advisory."
}
],
"title": "Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys",
"workarounds": [
{
"lang": "en",
"value": "Blocking or requiring authentication on the OAuth dynamic client registration endpoint at a reverse proxy, gateway or WAF removes the anonymous bulk-sampling surface, which is the part of this issue reachable without an account. It does not make the generated values unpredictable, and it does not close the surfaces available to an authenticated user, so it narrows exposure rather than resolving it. Deployments that do not use OAuth or MCP client integrations can apply this with no loss of function."
},
{
"lang": "en",
"value": "Rotating organization API keys or OAuth client secrets while still running an affected version does not help, and should not be relied on as a mitigation. The replacement value is produced by the same generator and is predictable on the same terms as the value it replaces. Rotation is only meaningful once the generator itself no longer draws from Math.random()."
},
{
"lang": "en",
"value": "Where the deployment allows it, restricting the public API to known client networks limits who can present a predicted credential. This is a containment measure for the consequence rather than a fix for the predictability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"assignerShortName": "postiz",
"cveId": "CVE-2026-94456",
"datePublished": "2026-09-22T16:11:33.674Z",
"dateReserved": "2026-09-21T17:11:13.201Z",
"dateUpdated": "2026-09-22T18:11:17.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-94456",
"date": "2026-09-24",
"epss": "0.00522",
"percentile": "0.41802"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"packageName": "postiz-app",
"product": "postiz-app",
"repo": "https://github.com/gitroomhq/postiz-app",
"vendor": "GitroomHQ",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "4cdc9741-f887-419a-a2fd-acbbd2729276"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8\u2019s deterministic xorshift128+ PRNG state.\n\nAn unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations."
}
],
"id": "CVE-2026-94456",
"lastModified": "2026-09-22T19:37:36.747",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-94456",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:10:57.774548Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-22T17:17:31.670",
"references": [
{
"source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"url": "https://gadvisory.org/advisories/PSA-2026-TD98KY"
},
{
"source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"url": "https://github.com/gitroomhq/postiz-app"
},
{
"source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"url": "https://github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d7ffba63"
},
{
"source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.24.0"
}
],
"sourceIdentifier": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-330"
},
{
"lang": "en",
"value": "CWE-338"
},
{
"lang": "en",
"value": "CWE-341"
}
],
"source": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:10:57.774548Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:11:02.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "postiz-app",
"product": "postiz-app",
"repo": "https://github.com/gitroomhq/postiz-app",
"vendor": "GitroomHQ",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All deployments running the released code up to and including v2.23.0 are affected, self-hosted and hosted alike. The identifier helper is shared code reached by every credential-minting path, and there is no feature flag, environment variable or build option that selects a different random source."
},
{
"lang": "en",
"value": "The anonymous sampling surface, the OAuth dynamic client registration endpoint, is registered in both the default controller set and the MCP_ONLY controller set, so it is reachable in either deployment mode."
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Santosh Kumar Puppala"
},
{
"lang": "en",
"type": "coordinator",
"value": "Enno Gelhaus"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nevo David"
}
],
"datePublic": "2026-09-22T14:17:43.125Z",
"descriptions": [
{
"lang": "en",
"value": "Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8\u2019s deterministic xorshift128+ PRNG state.\n\nAn unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations."
}
],
"exploits": [
{
"lang": "en",
"value": "No public exploit code is known. The original submission was methodology-only and deliberately omitted a working implementation."
}
],
"impacts": [
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker who predicts an OAuth access token minted for another organization is authenticated as that organization with SUPERADMIN rights over the public API, giving full read and write access to its scheduled posts, connected social accounts, media and team membership."
}
]
},
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "The per-organization API key generated at registration is drawn from the same generator and is honoured by the same middleware with the same SUPERADMIN grant, so an attacker sampling the generator around a signup can predict the API key of a newly created organization."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "OAuth client secrets, including those returned by anonymous dynamic client registration and by secret rotation, are predictable, allowing an attacker to impersonate a registered OAuth or MCP client to the token endpoint."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Authorization codes issued at the consent step are predictable, exposing in-flight OAuth authorization flows to interception and redemption by a third party."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "PKCE code verifiers generated for social account connections are predictable, removing the protection PKCE is present to provide for those provider flows."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-330",
"description": "CWE-330",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-341",
"description": "CWE-341",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T16:16:23.351Z",
"orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"shortName": "postiz"
},
"references": [
{
"name": "Postiz",
"tags": [
"product"
],
"url": "https://github.com/gitroomhq/postiz-app"
},
{
"name": "v2.24.0",
"tags": [
"release-notes"
],
"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.24.0"
},
{
"name": "9259cf24",
"tags": [
"patch"
],
"url": "https://github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d7ffba63"
},
{
"name": "GAdvisory",
"tags": [
"vendor-advisory"
],
"url": "https://gadvisory.org/advisories/PSA-2026-TD98KY"
}
],
"solutions": [
{
"lang": "en",
"value": "Run a Postiz release in which security-sensitive identifiers are generated from a cryptographically secure random source rather than from Math.random(). No fixed release is available at the time of writing; this advisory will record the fixed version once one is published."
},
{
"lang": "en",
"value": "Once running a release with a corrected generator, treat every credential issued by an affected version as compromised and replace it. That covers organization API keys, OAuth application client secrets, and any outstanding OAuth access tokens and authorizations. Outstanding authorization codes are short-lived and expire on their own."
},
{
"lang": "en",
"value": "Operators who connected social accounts while running an affected version should review those connections, since the PKCE verifiers used to establish them were drawn from the same generator."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T13:34:00.000Z",
"value": "Postiz has received and acknowledged the report."
},
{
"lang": "en",
"time": "2026-09-21T20:15:00.000Z",
"value": "Postiz has verified the report."
},
{
"lang": "en",
"time": "2026-09-22T04:32:00.000Z",
"value": "Postiz has developed and verified the patch."
},
{
"lang": "en",
"time": "2026-09-22T14:17:00.000Z",
"value": "Postiz has released the patch notes and published the advisory."
}
],
"title": "Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys",
"workarounds": [
{
"lang": "en",
"value": "Blocking or requiring authentication on the OAuth dynamic client registration endpoint at a reverse proxy, gateway or WAF removes the anonymous bulk-sampling surface, which is the part of this issue reachable without an account. It does not make the generated values unpredictable, and it does not close the surfaces available to an authenticated user, so it narrows exposure rather than resolving it. Deployments that do not use OAuth or MCP client integrations can apply this with no loss of function."
},
{
"lang": "en",
"value": "Rotating organization API keys or OAuth client secrets while still running an affected version does not help, and should not be relied on as a mitigation. The replacement value is produced by the same generator and is predictable on the same terms as the value it replaces. Rotation is only meaningful once the generator itself no longer draws from Math.random()."
},
{
"lang": "en",
"value": "Where the deployment allows it, restricting the public API to known client networks limits who can present a predicted credential. This is a containment measure for the consequence rather than a fix for the predictability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"assignerShortName": "postiz",
"cveId": "CVE-2026-94456",
"datePublished": "2026-09-22T16:11:33.674Z",
"dateReserved": "2026-09-21T17:11:13.201Z",
"dateUpdated": "2026-09-22T18:11:17.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…