Executive brief
Mixpost, a self-hosted social media management platform, is vulnerable to a security flaw where attackers can execute malicious code in a user's browser. By tricking an authenticated user into clicking a specially crafted link, an attacker could steal login sessions, perform unauthorized actions on the user's behalf, or display fraudulent login prompts. This occurs because the software fails to properly clean error messages received during the social media account linking process.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Mixpost's OAuth callback controller (CallbackSocialProviderController.php). The application retrieves the 'error' query parameter from the URL and stores it directly into a Laravel flash message without sanitization. This message is subsequently passed as an Inertia prop and rendered in the frontend (Notifications.vue) using Vue's v-html directive, which interprets the raw string as HTML. An unauthenticated attacker can satisfy the controller's preconditions by providing dummy OAuth tokens and then embedding a malicious payload in the error parameter. Successful exploitation requires a victim to visit the crafted URL, potentially leading to session hijacking or unauthorized administrative actions.
Affected products
- Inovector Mixpost through 2.6.0
Timeline
- 2026-05-24: disclosed: Initial report to vendor via email
- 2026-06-17: disclosed: Public issue opened on GitHub after no response
- 2026-06-29: advisory: CVE published to NVD