Read the docs
TI-2026-63438 Aliases CVE-2026-94456

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization…

Priority MEDIUM 48CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Fix Fixed postiz-app (GitroomHQ): 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gitroomhqpostiz-appbefore 2.4.02.4.0Patch availableCNA
  • postiz-app Vendorgitroomhq Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:*——gitroomhq
  • cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:* Versions — — ·gitroomhq

Remediation

  • Fix · CNA postiz-app (GitroomHQ) Fixed in 2.4.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GitroomHQ postiz-app 2.4.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-63437 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API keyPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-94456

References

Patch 1

Advisory 1

Other 2

  • TI-2026-26825 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CVSS 3.1HIGH 8.6
  • TI-2026-28982 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream CVSS 3.1HIGH 8.2
  • TI-2026-29238 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CVSS 3.1CRITICAL 9.0
  • TI-2026-26824 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CVSS 4.0HIGH 8.3
  • TI-2026-26837 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CVSS 3.1MEDIUM 5.4
  • TI-2026-15715 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover CVSS 4.0CRITICAL 9.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences