CVE-2026-94456

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gadvisory.org/advisories/PSA-2026-TD98KY
https://github.com/gitroomhq/postiz-app
https://github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d7ffba63
https://github.com/gitroomhq/postiz-app/releases/tag/v2.24.0

Configurations

No configuration.

History

22 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-22 17:17

Updated : 2026-09-22 19:37

NVD link : CVE-2026-94456

Mitre link : CVE-2026-94456

CVE.ORG link : CVE-2026-94456

JSON object : View

Products Affected

No product.

CWE

CWE-330

Use of Insufficiently Random Values

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-341

Predictable from Observable State

{"id": "CVE-2026-94456", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94456", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-22T18:10:57.774548Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "4cdc9741-f887-419a-a2fd-acbbd2729276", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "4cdc9741-f887-419a-a2fd-acbbd2729276", "affectedData": [{"repo": "https://github.com/gitroomhq/postiz-app", "vendor": "GitroomHQ", "product": "postiz-app", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.0", "versionType": "semver"}], "packageName": "postiz-app", "defaultStatus": "unaffected"}]}], "published": "2026-09-22T17:17:31.670", "references": [{"url": "https://gadvisory.org/advisories/PSA-2026-TD98KY", "source": "4cdc9741-f887-419a-a2fd-acbbd2729276"}, {"url": "https://github.com/gitroomhq/postiz-app", "source": "4cdc9741-f887-419a-a2fd-acbbd2729276"}, {"url": "https://github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d7ffba63", "source": "4cdc9741-f887-419a-a2fd-acbbd2729276"}, {"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.24.0", "source": "4cdc9741-f887-419a-a2fd-acbbd2729276"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "4cdc9741-f887-419a-a2fd-acbbd2729276", "description": [{"lang": "en", "value": "CWE-330"}, {"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-341"}]}], "descriptions": [{"lang": "en", "value": "Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8\u2019s deterministic xorshift128+ PRNG state.\n\nAn unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations."}], "lastModified": "2026-09-22T19:37:36.747", "sourceIdentifier": "4cdc9741-f887-419a-a2fd-acbbd2729276"}