Executive Summary
CVE-2026-115933 is a critical (CVSS 9.9) vulnerability in Postiz. The application signs its session, invitation and password reset tokens with a single shared secret and includes no marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signs data taken from the request itself and stores the result where the requesting user can read it.
Because all token types share one signing key and are indistinguishable, a token minted by that route can be reused as a different kind of token.
Vulnerability Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-115933 |
| CVSS Score | 9.9 (Critical) |
| Published | 2026-10-24 |
| Weakness Class | Token type confusion / signing key reuse |
Technical Summary
- Session, invitation and password reset tokens are signed with the same secret.
- Tokens carry no purpose or audience claim, so a verifier cannot tell which kind it received.
- The browser-extension channel credential refresh route signs attacker-influenced request data and returns the result to the requester.
The practical consequence is that a user can obtain a validly signed token containing content they chose, then present it where another token type is expected.
Remediation
- Check the NVD entry and the Postiz project for a fixed release and upgrade promptly.
- Rotate the shared signing secret after upgrading, which invalidates all outstanding tokens.
- Review logs for unexpected use of the browser-extension channel refresh route and for unusual invitation or password reset activity.
- Longer term, use separate keys and explicit purpose claims for each token type.