CVE-2026-94456: Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Vulnerability summary

CVE-2026-94456 is a critical (CVSS 9.1) Use of Insufficiently Random Values vulnerability in gitroomhq postiz-app. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.4% of scored vulnerabilities.

Timeline

1. 22-09-2026
   PublishedVulnerability first disclosed.
2. 22-09-2026
   Last modifiedVulnerability information updated.

Description

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.

• CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
• CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
• CWE-341Predictable from Observable StateA number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.