CVE-2026-57958 is a reflected cross-site scripting vulnerability affecting inovector's Mixpost product through version 2.6.0. The issue occurs because the OAuth callback controller fails to sanitize error query parameters before rendering them through Laravel flash messages using the Vue v-html directive. This allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of authenticated users by crafting malicious OAuth callback URLs. The vulnerability can be exploited to hijack user sessions or perform unauthorized actions. The CVSS 4.0 score is 5.1 (medium severity). No vendor advisory or patch information is provided, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of authenticated users' browsers. This can lead to session hijacking or unauthorized actions within the Mixpost application. The vulnerability impacts user trust and application security but requires user interaction (clicking a crafted URL). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with OAuth callback URLs and avoid clicking suspicious links. Application administrators should monitor for vendor updates and apply patches promptly once released.