CVE-2026-57958

Name of the Vulnerable Software and Affected Versions Mixpost versions prior to 2.6.1

Description A reflected cross-site scripting issue exists where unauthenticated attackers can execute arbitrary JavaScript in the browsers of authenticated users. This occurs because the OAuth callback controller fails to sanitize error query parameters before they are rendered via Laravel flash messages using the Vue v-html directive. An attacker can exploit this by crafting malicious OAuth callback URLs to hijack sessions or perform unauthorized actions.

Recommendations Update Mixpost to a version newer than 2.6.0.