PT-2026-41976 · Npm+1 · @Haxtheweb/Haxcms-Nodejs+1
CVE-2026-46395
·
Published
2026-05-19
·
Updated
2026-06-06
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
HAX CMS versions prior to 26.0.0
Description
The
hmacBase64() function in the HAXcms Node.js backend contains two cryptographic implementation errors. First, the function uses a hardcoded literal string "0" as the HMAC signing key instead of the intended key parameter. Second, the function appends the system's master signing secret, consisting of this.privateKey + this.salt, directly to the HMAC output before base64-encoding the result. This allows an unauthenticated attacker to extract the private signing key by base64-decoding a token and discarding the first 32 bytes. The extracted key can then be used to forge admin-level JSON Web Tokens (JWTs), granting full administrative access. The unauthenticated endpoint "/system/api/connectionSettings" returns tokens generated by this function, enabling the private key to be exposed via a single GET request.Recommendations
Update to version 26.0.0.
As a temporary workaround, restrict access to the "/system/api/connectionSettings" endpoint to minimize the risk of private key exposure.
Exploit
Fix
Information Disclosure
Use of a Broken Cryptographic Algorithm
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Haxtheweb/Haxcms-Nodejs
Haxcms-Nodejs