Postiz CVE-2026-94456

Exploitation requires that Postiz's unauthenticated OAuth dynamic client registration endpoint be enabled and network-reachable, since that endpoint is what returns freshly Math.random()-generated client credentials to the attacker. The core weakness is the shared credential helper using Math.random() (V8's deterministic xorshift128+) rather than a CSPRNG for OAuth access tokens, authorization codes, client secrets, org API keys, and PKCE verifiers. Practical exploitation is LIMITED by the need to capture enough consecutive, uncontaminated PRNG outputs to solve for internal state - concurrent credential generation from other users interleaves draws and degrades recoverability - and by deployment on a fixed version prior to v2.24.0. No user interaction or authentication is required to reach the leaking endpoint.

This is a genuinely high-priority weakness, not a CVSS-inflated one. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, base 9.1) reflects a real, network-reachable, unauthenticated credential-compromise path: predictable Math.random()-derived OAuth tokens, client secrets, org API keys, and PKCE verifiers, combined with an unauthenticated OAuth dynamic client registration endpoint that leaks enough consecutive V8 xorshift128+ output to reconstruct PRNG state. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation-likelihood signals are absent - this rests on the CVSS vector, the description, and a confirmed vendor patch. I assess Attack Complexity as higher than the vendor's AC:L: reconstructing xorshift128+ state requires harvesting consecutive, uncontaminated PRNG outputs (concurrent requests from other users interleave draws and pollute the sequence) plus a lattice/solver step, which is a well-documented but non-trivial technique. Net: technically severe and remotely reachable, but real-world exploitation demands specific state-recovery effort rather than a one-shot request. No conflicting signals in the raw data, but note the absence of any exploitation-probability evidence.

An unauthenticated attacker repeatedly calls Postiz's OAuth dynamic client registration endpoint, collecting the freshly generated client credentials whose bytes come directly from Math.random(). After gathering enough consecutive outputs, they reconstruct the V8 xorshift128+ internal state and deterministically compute PRNG values produced before and after their samples - forging or predicting OAuth access tokens, authorization codes, and org API keys belonging to other tenants. No public exploit was identified at time of analysis, though the underlying V8 PRNG-recovery technique is publicly known.