CVE-2026-57958: Reflected XSS in Mixpost OAuth Callback – Session Hijacking Risk

Technical summary

The vulnerability exists in Mixpost's OAuth callback controller, which fails to sanitize the error query parameter before rendering it through Laravel flash messages. The flash message is subsequently rendered using Vue's v-html directive, which interprets the unsanitized content as HTML and executes embedded JavaScript. An unauthenticated attacker can construct a callback URL containing malicious JavaScript payload in the error parameter. When an authenticated user follows this URL, the payload executes in their browser context with full access to their session and application state. The attack vector is network-based with low complexity; exploitation requires user interaction (clicking the link) but no special privileges.

Business impact

This vulnerability poses a direct risk to Mixpost users' authenticated sessions and data. Attackers could steal session tokens, perform unauthorized posts or account modifications, access connected social media accounts, or exfiltrate sensitive account information. For organizations using Mixpost for social media management, a successful attack could result in unauthorized content publication, brand damage, compromised credentials for connected social platforms, and loss of control over managed accounts. The low barrier to exploitation—requiring only a crafted URL and user click—means this threat is practical to execute at scale.

Affected systems

Mixpost versions up to and including 2.6.0 are vulnerable. The vulnerability affects all deployments of this version, regardless of deployment environment or configuration, as the flaw is in the core OAuth callback handler. Any installation where users may click external links or where attackers can inject links into communications (email, chat, etc.) targeting Mixpost users is at risk.

Exploitability

This vulnerability is straightforward to exploit. An attacker needs only to craft a URL containing JavaScript payload in the error parameter and socially engineer an authenticated Mixpost user into clicking it. No authentication is required on the attacker's part, network access is unrestricted, and the technical complexity is minimal. The primary barrier to exploitation is user interaction—the victim must click the link while logged into Mixpost. This is a practical exploitation scenario in phishing campaigns, malicious link injection, or compromised referral sources. The CVSS score of 6.1 (Medium) reflects the moderate impact potential tempered by the requirement for user interaction.

Remediation

Upgrade Mixpost to a version newer than 2.6.0 that includes proper sanitization of OAuth error parameters. Verify against the Mixpost security advisory for the specific patched version number and release date. Until patching is possible, implement network-based protections such as URL filtering to block known malicious callback domains and security awareness training to reduce the likelihood of users clicking untrusted links.

Patch guidance

Check the official Mixpost repository and security advisories for the patched version that resolves this vulnerability. Apply the update following Mixpost's standard deployment procedures for your installation method. Verify that the patch includes proper input sanitization of OAuth error parameters before rendering. If Mixpost is deployed in a containerized environment, ensure container images are rebuilt with the patched version. Test the update in a non-production environment first to confirm compatibility with your configuration and plugins.

Detection guidance

Monitor access logs for unusual OAuth callback requests containing suspicious characters or HTML/JavaScript syntax in the error parameter. Watch for patterns like %3C, %3E, javascript:, or onerror= in callback URLs. Implement web application firewall (WAF) rules to block callback URLs containing unencoded angle brackets or event handler attributes in query parameters. Check browser console logs on Mixpost instances for unexpected JavaScript execution errors or warnings. Review authentication logs for sessions showing unusual activity immediately after OAuth callback events.

Why prioritize this

While rated CVSS Medium (6.1), this vulnerability merits prompt attention because it enables direct compromise of authenticated user sessions with minimal attacker effort and practical exploitation vectors. The reliance on user interaction is common in real-world attacks and should not be underestimated. Organizations managing important social media accounts through Mixpost face real brand and credential risk. This is not a CISA KEV entry, but the attack surface and impact justify prioritization ahead of lower-impact issues.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects: Network-based attack vector (no special access required), Low complexity (simple URL crafting), No privileges required to exploit, User interaction required (moderate mitigation factor), Changed scope (affects resources beyond the vulnerable component via session hijacking), and Low confidentiality and integrity impacts (compromised sessions and unauthorized actions). The score would be higher were authentication not required on the user end; the user interaction requirement prevents a Critical or High rating despite the practical exploitability.

Frequently asked questions