PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46391 haxtheweb CVE debrief

A vulnerability in HAX CMS, specifically in the @haxtheweb/open-apis package versions 9.0.1 to 25.0.0, allows attackers to capture authentication. The issue arises from multiple functions that conduct substring-only matching to validate hostnames for basic authorization. An attacker can exploit this by appending the matched substrings to an attacker-controlled endpoint, thereby capturing authentication. This vulnerability has a CVSS score of 8.7 and is classified as HIGH severity.

Vendor
haxtheweb
Product
@haxtheweb/open-apis
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-06-08
Advisory published
2026-06-05
Advisory updated
2026-06-08

Who should care

Users of HAX CMS, specifically those using @haxtheweb/open-apis versions 9.0.1 to 25.0.0, should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability is caused by substring-only matching in multiple functions used for validating hostnames to which basic authorization should be sent. This allows an attacker to append the matched substrings to an attacker-controlled endpoint and capture authentication.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to version 26.0.0 of @haxtheweb/open-apis to fix the issue.
  • Review and update configurations to ensure that only authorized endpoints are used for basic authorization.

Evidence notes

The vulnerability is confirmed by the CVE record and details from the NVD.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46391 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46391

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46391 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46391

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.