PT-2026-47039 · Haxtheweb · Hax Cms Php

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-46398

Mitre

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms refresh token cookie is set without the Secure flag. This allows it to be transmitted over unencrypted HTTP, making it vulnerable to theft via packet sniffing on the network. Version 26.0.0 fixes the issue.

Fix

Weakness Enumeration

CWE-614

Related Identifiers

CVE-2026-46398

Affected Products

Hax Cms Php

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-46398 · Security Note
• https://github.com/haxtheweb/issues/security/advisories/GHSA-g7v2-r32q-jf5v · Note