CVE-2026-57958
Mixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenticated users' browsers by crafting malicious OAuth callback URLs with unsanitized error query parameters. Attackers can exploit the OAuth callback controller's failure to sanitize error parameters before rendering them through Laravel flash messages via the Vue v-html directive to hijack authenticated user sessions or perform unauthorized actions.
| CWE | CWE-79 |
| Vendor | inovector |
| Product | mixpost |
| Published | Jun 29, 2026 |
| Last Updated | Jun 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for inovector mixpost
Be the first to know when new medium vulnerabilities affecting inovector mixpost are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
inovector / mixpost
0 ≤ 2.6.0
References
Credits
George Chen