Postiz Token Signing Flaw Enables Session and Password Reset Forgery

Postiz has a token signing vulnerability: it signs session, invitation, and password reset tokens with one shared secret and without any marker of what a token is for.

A route that refreshes the credentials of a browser-extension channel signs data taken from the request itself and stores the result where the requesting user can read it back. This lets a user obtain a validly signed token containing any claims they choose.

That token is accepted as any of the following:

• a session
• an organization invitation with a chosen role
• a password reset
• an enterprise provisioning token

A second, narrower route that creates team invitations signs extra fields from the request body in the same way.