CVE-2026-94456: Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
Postiz generates security-sensitive credentials using Math.random() instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state.
An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Treat every credential issued by an affected Postiz version as compromised and replace organization API keys, OAuth application client secrets, outstanding OAuth access tokens, and authorizations.
- Operational
Review social-account connections established while running an affected version because their PKCE verifiers may have been generated by the compromised PRNG.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can use the unauthenticated OAuth dynamic client registration endpoint to obtain freshly generated client credentials and recover the PRNG state.
Which credentials may be exposed after the PRNG state is recovered?
The affected generator is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers. Recovered state may allow deterministic derivation of both past and future values generated by that helper.
Are credentials from other users or organizations potentially at risk?
Yes. Because the generator state can be used to derive values outside the attacker's own registration flow, credentials belonging to other users and organizations may be compromised.