CVE-2026-94456

Summary

The flaw lies in Postiz's use of `Math.random()` for generating security-sensitive credentials, which is not cryptographically secure. Attackers can exploit this to reconstruct the PRNG state and derive past and future credentials, compromising user and organization security.

Exploitability

Exploitation is moderately hard as it requires access to the unauthenticated OAuth dynamic client registration endpoint and knowledge of the PRNG state. Precondition is the availability of the endpoint and the ability to observe consecutive PRNG outputs.

Blast radius

If exploited, the impact is severe as it could compromise credentials for multiple users and organizations, leading to potential unauthorized access and data breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or upgrade to the latest version of Postiz that addresses this vulnerability, as no specific version is mentioned in the description.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.