External risk intelligence

HAX CMS Node.js Private Key Exposure via Cryptographic Errors

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-46395

HAX CMS is a web-based content management system. The vulnerability exists in a Node.js backend endpoint, /system/api/connectionSettings, which is unauthenticated. As a web application managing microsites, such platforms are commonly deployed as internet-facing services, making the API endpoint reachable and exploitable from the public internet.

Information Disclosure

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Node.js backend of HAX CMS, an application used for managing microsites. This issue allows unauthenticated attackers to potentially gain full administrative access by extracting the system's private signing key, which could compromise the integrity of the managed microsites. The main concern is confirming the relevance and exposure of this vulnerability within our environment.

HAX CMS backend flaw allows unauthorized admin access.
Attackers can steal the private key for full control.
Confirm HAX CMS Node.js usage and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by making a single HTTP request to an unauthenticated API endpoint. This request targets a flawed cryptographic function within the Node.js backend that incorrectly handles the signing key, inadvertently exposing the system's private signing secret. Once this secret is obtained, the attacker can forge administrative JSON Web Tokens (JWTs) to gain full control of the HAX CMS.

No authentication needed.
Trigger vulnerable API endpoint.
Gain full admin access.

Live Threat

Current exploitation, exposure, and threat context

The Node.js backend of HAX CMS, when unauthenticated, could expose the system's private signing key. This key is used to generate administrative JSON Web Tokens (JWTs), and its compromise allows an attacker to forge these tokens, leading to full administrative access to the system. This exposure can occur through a single HTTP request to an unauthenticated endpoint.

System's private signing key.
Via unauthenticated API request.
Full administrative access gained.

Operational Fix

Recommended remediation, mitigation, and detection steps

The HAX CMS Node.js backend is affected by a critical vulnerability allowing unauthenticated attackers to extract the system's private signing key and forge admin tokens. Platform or application owners should prioritize identifying all instances of the Node.js backend, confirming exposure and criticality, and then planning remediation.

Platform/application owners should address this.
Verify Node.js backend instances and exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is HAX CMS?

HAX CMS is a web-based content management system designed to manage a universe of microsites. It offers flexible backend options, including both PHP and Node.js environments. The vulnerability specifically affects the Node.js implementation, which serves as the framework for handling site data and administrative functions.

How does CVE-2026-46395 compromise security?

This vulnerability involves cryptographic implementation errors, specifically categorized as CWE-200 (exposure of sensitive information), CWE-321 (use of hard-coded cryptographic key), and CWE-327 (use of broken cryptographic algorithm). In the Node.js version, the system accidentally attaches its own private signing key to the output of a function, allowing anyone to read the secret and forge administrative tokens.

What triggers this vulnerability in HAX CMS?

An attacker triggers this by sending a single unauthenticated HTTP request to the /system/api/connectionSettings endpoint. The PHP version of the software is not affected because it handles cryptographic operations correctly. Simply having the Node.js version running is the condition that enables the exposure.

Is my instance of HAX CMS at risk?

According to Halo Surface Signal, HAX CMS is often deployed as an internet-facing service, meaning the vulnerable endpoint is likely reachable from the public internet. If your instance runs the Node.js backend, it is exposed to remote, unauthenticated access, making it a high priority for review.

How do I fix this HAX CMS vulnerability?

The primary response is to update your software to version 26.0.0, which contains the fix for the cryptographic errors. Start by identifying all instances of HAX CMS in your environment that utilize the Node.js backend, confirm their version, and apply the update to prevent the exposure of your private signing keys.

References

github.com/haxtheweb/issues/security/advisories/GHSA-6c8g-9hfh-p…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.