vulnerability
Postiz's One Signing Key Opened Four Doors
Postiz signs session, invitation, and password-reset tokens with one shared secret and no marker of what each token is for. A signed-in user could mint a validly signed token carrying any claims. Three critical CVEs, fixed in v2.25.3.