CVE-2026-46511
CVE-2026-46511 · HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
This page contains facts from public vulnerability sources. Check the original advisory before updating.
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover. The API dynamically leaks the active session's authentication tokens (including the `jwt`, `user_token`, `site_token`, and `appstore_token`) into a global JavaScript variable (`window.appSettings`). An attacker can exploit the XSS vulnerability to force a victim's browser to silently fetch their specific connection settings, extract the tokens, and exfiltrate them to an attacker-controlled webhook. Version 26.0.0 patches the issue.
CVSS 8.7 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
haxcms-nodejs
- Versions
- < 26.0.0: Affected
No fix published
haxcms-php
- Versions
- < 26.0.0: Affected
No fix published
@haxtheweb/haxcms-nodejs npm
- Affected ranges
- SEMVER: < 26.0.0
Update to 26.0.0