Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
Summary
| CVE | CVE-2026-94456 |
|---|---|
| State | PUBLISHED |
| Assigner | postiz |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-22 17:17:31 UTC |
| Updated | 2026-09-22 19:37:36 UTC |
| Description | Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations. |
Risk And Classification
Primary CVSS: v3.1 9.1 CRITICAL from 4cdc9741-f887-419a-a2fd-acbbd2729276
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Problem Types: CWE-330 | CWE-338 | CWE-341 | CWE-338 CWE-338 | CWE-330 CWE-330 | CWE-341 CWE-341
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 4cdc9741-f887-419a-a2fd-acbbd2729276 | Secondary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | CNA | CVSS | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | GitroomHQ | Postiz-app | affected 2.4.0 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/gitroomhq/postiz-app | 4cdc9741-f887-419a-a2fd-acbbd2729276 | github.com | |
| github.com/gitroomhq/postiz-app/releases/tag/v2.24.0 | 4cdc9741-f887-419a-a2fd-acbbd2729276 | github.com | |
| github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d... | 4cdc9741-f887-419a-a2fd-acbbd2729276 | github.com | |
| gadvisory.org/advisories/PSA-2026-TD98KY | 4cdc9741-f887-419a-a2fd-acbbd2729276 | gadvisory.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Santosh Kumar Puppala (en)
CNA: Enno Gelhaus (en)
CNA: Nevo David (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-09-21T13:34:00.000Z | Postiz has received and acknowledged the report. |
| CNA | 2026-09-21T20:15:00.000Z | Postiz has verified the report. |
| CNA | 2026-09-22T04:32:00.000Z | Postiz has developed and verified the patch. |
| CNA | 2026-09-22T14:17:00.000Z | Postiz has released the patch notes and published the advisory. |
Solutions
CNA: Run a Postiz release in which security-sensitive identifiers are generated from a cryptographically secure random source rather than from Math.random(). No fixed release is available at the time of writing; this advisory will record the fixed version once one is published.
CNA: Once running a release with a corrected generator, treat every credential issued by an affected version as compromised and replace it. That covers organization API keys, OAuth application client secrets, and any outstanding OAuth access tokens and authorizations. Outstanding authorization codes are short-lived and expire on their own.
CNA: Operators who connected social accounts while running an affected version should review those connections, since the PKCE verifiers used to establish them were drawn from the same generator.
Workarounds
CNA: Blocking or requiring authentication on the OAuth dynamic client registration endpoint at a reverse proxy, gateway or WAF removes the anonymous bulk-sampling surface, which is the part of this issue reachable without an account. It does not make the generated values unpredictable, and it does not close the surfaces available to an authenticated user, so it narrows exposure rather than resolving it. Deployments that do not use OAuth or MCP client integrations can apply this with no loss of function.
CNA: Rotating organization API keys or OAuth client secrets while still running an affected version does not help, and should not be relied on as a mitigation. The replacement value is produced by the same generator and is predictable on the same terms as the value it replaces. Rotation is only meaningful once the generator itself no longer draws from Math.random().
CNA: Where the deployment allows it, restricting the public API to known client networks limits who can present a predicted credential. This is a containment measure for the consequence rather than a fix for the predictability.
Exploits
CNA: No public exploit code is known. The original submission was methodology-only and deliberately omitted a working implementation.