CVE-2026-94456: critical vulnerability in GitroomHQ postiz-app
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 0.5%
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state.
An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
GitroomHQ · postiz-appRelated CVEs — GitroomHQ postiz-app
In the same product, most dangerous first.
CVE-2026-115931CRITICALArbitrary file read and backend crash through unrestricted provider method callsEPSS 0.5%CVE-2026-115932CRITICALPath traversal in post media lets any registered user read server filesEPSS 0.4%CVE-2026-19127MEDIUMInsufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptionsEPSS 0.3%CVE-2026-107761MEDIUMChannel tokens and organization API key exposed in API responsesEPSS 0.3%CVE-2026-94455HIGHUnauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API keyEPSS 0.3%CVE-2026-115933CRITICALForged signed tokens let any registered user take over other users and organizationsEPSS 0.2%