Executive brief
Postiz, a social media scheduling platform, generates security-critical credentials like API keys, OAuth tokens, and authorization codes using an insecure random number generator (Math.random()) instead of a cryptographically secure source. An unauthenticated attacker can recover the internal state of the random generator by sampling an exposed OAuth registration endpoint, then predict all past and future credentials issued by affected instances, including those belonging to other organizations. This allows attackers to impersonate other users with administrative access to their accounts and social media connections.
Technical details
Postiz uses a shared credential generation helper that draws from Math.random(), which implements V8's deterministic xorshift128+ PRNG. An unauthenticated endpoint at the OAuth dynamic client registration exposes freshly generated client credentials in bulk, providing enough consecutive PRNG output to reconstruct the internal generator state via linear algebra. Once recovered, an attacker can derive all past and future credentials (OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers) deterministically.
Affected products
- GitroomHQ postiz-app up to and including 2.3.0
Timeline
- 2026-09-22: disclosed: CVE-2026-94456 published