EUVD-2026-40143
GHSA-x4g3-x4c9-rjf8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflected XSS crosses browser scope boundary (S:C); attacker is unauthenticated (PR:N) but victim click is required (UI:R); C:L/I:L for session theft and unauthorized actions; no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenticated users' browsers by crafting malicious OAuth callback URLs with unsanitized error query parameters. Attackers can exploit the OAuth callback controller's failure to sanitize error parameters before rendering them through Laravel flash messages via the Vue v-html directive to hijack authenticated user sessions or perform unauthorized actions.
AnalysisAI
Reflected XSS in Mixpost through version 2.6.0 enables unauthenticated remote attackers to execute arbitrary JavaScript in authenticated users' browsers by delivering crafted OAuth callback URLs containing malicious error query parameters. The OAuth callback controller fails to sanitize error parameters before routing them through Laravel flash messages, which are then rendered by Vue's v-html directive without HTML escaping - creating a direct injection path into the DOM. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity and zero-privilege requirement make delivery straightforward once a victim is identified.
Technical ContextAI
Mixpost is a self-hosted social media management application built on the Laravel PHP framework with a Vue.js frontend. The vulnerable code path exists in the OAuth callback controller, which processes responses from third-party OAuth providers (e.g., social media platforms). When an OAuth error occurs, the error query parameter from the callback URL is passed unsanitized into Laravel's flash message system - a session-based one-time message mechanism. The flash message content is then rendered in the Vue frontend using Vue's v-html directive, which intentionally bypasses Vue's default template escaping to render raw HTML. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the precise root cause: attacker-controlled data from the URL query string flows into an HTML-rendering context without output encoding at any stage of the pipeline. CPE data was not provided in the input, but the upstream repository is inovector/mixpost on GitHub per the referenced issue.
RemediationAI
Upgrade Mixpost beyond version 2.6.0 once a patched release is confirmed available; however, an exact fixed version has not been independently confirmed from the available references - the GitHub issue (https://github.com/inovector/mixpost/issues/204) and VulnCheck advisory (https://www.vulncheck.com/advisories/mixpost-reflected-xss-via-oauth-callback-error-parameter) should be monitored for a confirmed patch. As an interim compensating control, deploy a Content Security Policy header that prohibits inline script execution (script-src 'self' without 'unsafe-inline'), which would neutralize the XSS payload even if the parameter is injected - though this may require testing against Mixpost's legitimate Vue.js rendering. Alternatively, restricting network access to the OAuth callback endpoint at the reverse proxy layer removes the attack surface entirely, with the trade-off of breaking OAuth social media login flows. Disabling all OAuth-connected social media integrations within Mixpost removes the vulnerable code path without application changes, but eliminates core product functionality. No workaround eliminates the root cause; only a vendor patch that properly encodes the error parameter before flash storage or replaces v-html with safe text rendering constitutes a full fix.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today