Vulnerability Description
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://gadvisory.org/advisories/PSA-2026-TD98KY
- https://github.com/gitroomhq/postiz-app
- https://github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d
- https://github.com/gitroomhq/postiz-app/releases/tag/v2.24.0
FAQ
What is CVE-2026-94456?
CVE-2026-94456 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets...
How severe is CVE-2026-94456?
CVE-2026-94456 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-94456?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.