PT-2026-41974 · Haxtheweb+1 · @Haxtheweb/Open-Apis

CVE-2026-46391 · Published 2026-05-19 · Updated 2026-06-06

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @haxtheweb/open-apis versions 9.0.1 through 25.x

Description Multiple functions perform substring-only matching to validate hostnames for basic authorization. This allows an attacker to append matched substrings to an attacker-controlled endpoint to capture authentication credentials and exfiltrate internal secrets. The issue exists in the logic used to check for hard-coded site names within the following files:

• api/services/website/cacheAddress.js
• api/apps/haxcms/lib/JOSHelpers.js
• api/apps/haxcms/convert/elmslnToSite.js

Recommendations Update to version 26.0.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

CWE-183

Related Identifiers

CVE-2026-46391

GHSA-4FG7-F244-3J49

Affected Products

@Haxtheweb/Open-Apis

References · 8

• 🔥 https://github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46391 · Security Note
• https://osv.dev/vulnerability/GHSA-4fg7-f244-3j49 · Vendor Advisory
• https://github.com/haxtheweb/issues · Note
• https://twitter.com/infoflowcloud/status/2063205785052582328 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2063119488023740665 · Twitter Post
• https://t.me/CVEtracker/55991 · Telegram Post
• https://twitter.com/CVEnew/status/2063205038525239707 · Twitter Post