CVE-2026-57958: Mixpost Reflected XSS Vulnerability

CVE-2026-57958 Overview

CVE-2026-57958 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] affecting Mixpost through version 2.6.0. The flaw resides in the OAuth callback controller, which fails to sanitize the error query parameter before passing it into a Laravel flash message. The Vue front-end then renders this message through the v-html directive, allowing arbitrary JavaScript execution in an authenticated user's browser. Unauthenticated attackers can craft malicious OAuth callback URLs and lure authenticated users into visiting them to hijack sessions or perform unauthorized actions inside Mixpost.

Critical Impact
Attackers can execute arbitrary JavaScript in authenticated Mixpost users' browsers, enabling session hijacking and unauthorized actions on the social publishing platform.

Affected Products

Mixpost through version 2.6.0
Deployments exposing the OAuth callback controller to untrusted input
Instances rendering Laravel flash messages via the Vue v-html directive

Discovery Timeline

2026-06-29 - CVE-2026-57958 published to the National Vulnerability Database (NVD)
2026-06-29 - NVD entry last modified

Technical Details for CVE-2026-57958

Vulnerability Analysis

Mixpost is an open-source social media management platform built on Laravel and Vue. The vulnerability affects the OAuth callback flow used when connecting third-party social accounts. When the OAuth provider returns an error response, Mixpost captures the error query parameter and stores it in a Laravel session flash message. The front-end template renders that flash message directly through the Vue v-html directive, which interprets the string as raw HTML rather than escaping it.

Because the value originates from an attacker-controlled URL and is reflected back to the browser without sanitization, injected markup and <script> payloads execute in the context of the authenticated Mixpost origin. The attack is reflected rather than stored, so exploitation requires user interaction with a crafted link.

Root Cause

The root cause is missing output encoding on user-supplied input flowing between two trust boundaries. The controller trusts the error query parameter, and the Vue component trusts the flash message. Neither layer applies HTML entity encoding, and the deliberate use of v-html bypasses Vue's default escaping. This is a textbook Improper Neutralization of Input During Web Page Generation issue [CWE-79].

Attack Vector

An unauthenticated attacker constructs an OAuth callback URL for a target Mixpost instance and appends a malicious payload inside the error parameter. The attacker delivers the link through phishing, social media, or embedded content. When an authenticated Mixpost user follows the link, the payload renders inside the application shell and executes with the victim's session privileges. Successful exploitation can exfiltrate session cookies, invoke authenticated API calls to publish or delete content, or pivot to connected social accounts. See the VulnCheck Security Advisory and the GitHub Issue Discussion for additional technical context.

Detection Methods for CVE-2026-57958

Indicators of Compromise

Requests to OAuth callback routes containing HTML tags, <script>, onerror=, or URL-encoded angle brackets in the error query parameter
Referer headers on Mixpost callback endpoints pointing to external phishing or link-shortener domains
Unexpected outbound requests from authenticated Mixpost sessions to attacker-controlled hosts shortly after callback visits

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the error query parameter on Mixpost OAuth callback URLs for HTML and JavaScript syntax
Search web server access logs for callback URIs whose error parameter length or character set deviates from legitimate OAuth error strings such as access_denied or invalid_request
Correlate browser Content Security Policy (CSP) violation reports with Mixpost origins to surface blocked inline script executions

Monitoring Recommendations

Alert on anomalous authenticated actions from Mixpost sessions immediately following an OAuth callback request
Monitor for session token reuse across geographies or user agents, which suggests session hijacking
Track spikes in 4xx responses on OAuth callback routes that may indicate probing for injection payloads

How to Mitigate CVE-2026-57958

Immediate Actions Required

Upgrade Mixpost to a release later than 2.6.0 once the maintainers publish a fix, tracked in the GitHub Issue Discussion
Place Mixpost behind a WAF and block requests where the OAuth callback error parameter contains HTML metacharacters
Instruct administrators and editors to avoid clicking OAuth callback links received from untrusted sources

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Administrators should monitor the Mixpost GitHub repository and the VulnCheck Security Advisory for release notes addressing the OAuth callback sanitization defect.

Workarounds

Apply a reverse-proxy rule that strips or rejects the error query parameter on Mixpost OAuth callback paths until an official patch is available
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Replace the Vue v-html binding on flash messages with a text binding in a local fork, ensuring HTML entities are escaped before rendering

bash

# Example Nginx snippet to drop the error parameter on Mixpost OAuth callbacks
location ~* /mixpost/.*/callback$ {
    if ($arg_error ~* "[<>\"'&]") {
        return 400;
    }
    proxy_pass http://mixpost_upstream;
}