Reflected Cross-Site Scripting Vulnerability in Mixpost by Inovector

CVE-2026-57958

What is CVE-2026-57958?

The Mixpost application, up to version 2.6.0, is susceptible to a reflected cross-site scripting (XSS) vulnerability. This issue arises when unauthenticated attackers craft malicious OAuth callback URLs with unsanitized error query parameters. When these URLs are processed by the OAuth callback controller, the vulnerability allows execution of arbitrary JavaScript in the browsers of authenticated users. The failure to properly sanitize these error parameters before being rendered via Laravel flash messages using the Vue v-html directive can lead to session hijacking or unauthorized actions within the application.

References