CVE-2026-94456
Received Received - Intake

Postiz OAuth Credential Generation Weakness via Math.random()

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: postiz

Description
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-94456
EUVD
EUVD-2026-84543

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gitroomhq postiz to 2.23.0 (inc)
gitroomhq postiz 2.24.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CWE-341 A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Postiz uses a weak random number generator (Math.random) for creating security-sensitive credentials like OAuth tokens and API keys. This generator is predictable, allowing attackers to guess or reconstruct credentials by observing enough outputs. A flawed OAuth endpoint exposes these credentials, enabling attackers to derive past and future values, compromising multiple accounts and systems.

Detection Guidance

Detecting this vulnerability requires checking if Postiz uses Math.random() for generating security-sensitive credentials. Inspect the source code for OAuth access tokens, client secrets, or API keys to see if they rely on Math.random(). Look for deterministic PRNG usage in credential generation logic.

Impact Analysis

If you use Postiz, attackers could steal your OAuth tokens, API keys, or other credentials. This could lead to unauthorized access to your accounts, data breaches, or impersonation. Since credentials are predictable, attackers might also compromise other users or organizations using the same system.

Compliance Impact

This vulnerability likely violates GDPR (data protection) and HIPAA (health data security) due to unauthorized access risks and potential data breaches. Organizations using Postiz could face legal penalties, fines, or reputational damage for failing to protect sensitive credentials and user data.

Mitigation Strategies

Immediately switch to cryptographically secure random number generators like crypto.randomBytes() or crypto.getRandomValues() for all credential generation. Disable the unauthenticated OAuth dynamic client registration endpoint if not required. Rotate all exposed credentials including OAuth tokens, client secrets, and API keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94456. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart