PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46395 haxtheweb CVE debrief

CVE-2026-46395 is a critical vulnerability in HAX CMS, a microsite universe management system with PHP or Node.js backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors. These errors allow any unauthenticated attacker to extract the system's private signing key and forge arbitrary admin-level JSON Web Tokens (JWTs), granting them full admin access with a single HTTP request.

Vendor
haxtheweb
Product
haxcms-nodejs
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-06-05
Advisory published
2026-06-05
Advisory updated
2026-06-05

Who should care

Administrators and users of HAX CMS, especially those using the Node.js backend, should be aware of this critical vulnerability. The PHP backend is not affected as it implements the function correctly.

Technical summary

The `hmacBase64()` function passes the literal string '0' as the HMAC signing key instead of the key parameter, resulting in identical HMACs for the same input across all HAXcms instances. After computing the HMAC, the function concatenates the real key parameter, which is 'this.privateKey + this.salt', directly onto the output. This allows an attacker to base64-decode any token, discard the first 32 bytes, and read the private key directly.

Defensive priority

High

Recommended defensive actions

  • Upgrade to version 26.0.0 or later of HAX CMS to fix the issue.
  • Use the PHP backend, which is not affected by this vulnerability.

Evidence notes

The `/system/api/connectionSettings` endpoint is unauthenticated and returns multiple tokens generated by the vulnerable `hmacBase64()` function. A single GET request to this endpoint can expose the private key.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46395 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46395

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46395 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46395

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.