Shared Secret Token Signing Enables Arbitrary Claim Injection

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Postiz contains a critical cryptographic vulnerability where session, invitation, and password reset tokens are all signed using a single shared secret without any token-type differentiation. This design flaw allows an attacker to obtain a validly signed token containing arbitrary claims by exploiting a browser-extension credential refresh route that accepts and signs user-controlled data. An attacker can forge tokens with any claims they choose—whether for session hijacking, privilege escalation through organization invitations with elevated roles, or account takeover via password reset tokens. This vulnerability affects all Postiz users, particularly those using browser extensions, as the lack of token-type markers means a password reset token can be reused as a session token and vice versa.

Casky.ai's 447 matching security skills, powered by Claude AI's extended reasoning capabilities, detect the attack patterns underlying this vulnerability across multiple MITRE ATT&CK tactics. Practitioners would identify TA0001 (Initial Access) through credential forgery, TA0043 (Reconnaissance) patterns as attackers probe the token signing mechanism, and TA0002 (Execution) as forged tokens grant unauthorized access. The skills map cryptographic misconfigurations like improper token validation (CWE-290, CWE-345) and unsafe use of externally-controlled format strings (CWE-915). In Casky findings, practitioners would see detections for: unsigned/unvalidated token claims, reuse of cryptographic material across different token purposes, and routes that accept user-supplied data in security-critical operations. The extended reasoning capability would correlate these signals to reveal the full token confusion attack chain, enabling defenders to prioritize authentication and authorization review across all token-dependent features.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-115933.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-115933

Casky has 447 skills that investigate the attack patterns behind CVE-2026-115933. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn