CVE-2026-57958

Description

Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenticated users' browsers by crafting malicious OAuth callback URLs with unsanitized error query parameters. Attackers can exploit the OAuth callback controller's failure to sanitize error parameters before rendering them through Laravel flash messages via the Vue v-html directive to hijack authenticated user sessions or perform unauthorized actions.

References

https://www.vulncheck.com/advisories/mixpost-reflected-xss-via-oauth-callback-error-parameter

https://github.com/inovector/mixpost/issues/204

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4