Executive brief
HAX open-apis is a Node.js library used to build web applications and learning management systems. The library improperly validates hostnames when sending HTTP requests with embedded credentials, allowing an attacker to craft malicious API calls that redirect authentication tokens to attacker-controlled servers. This enables theft of credentials that would grant access to internal systems and unreleased educational content.
Technical details
The vulnerability exists in three API endpoint handlers that perform inadequate hostname validation before sending HTTP requests with Basic Authentication credentials. Instead of exact hostname matching, the code performs substring matching (checking if a hard-coded domain name appears anywhere in a user-controlled URL parameter), which allows bypass by prepending or appending the substring to an attacker-controlled domain. An unauthenticated attacker can craft API calls with a malicious URL parameter containing the vulnerable substring, causing the application to send HTTP requests with embedded credentials to the attacker's server. The attack is network-reachable with no authentication or user interaction required. Patches are available in version 26.0.0 and later.
Affected products
- HAX @haxtheweb/open-apis 9.0.1 through 25.x; fixed in 26.0.0
Timeline
- 2026-05-19: disclosed: GHSA-4fg7-f244-3j49 published
- 2026-06-05: other: NVD published CVE-2026-46391
- 2026-05-19: patched: Patch available in version 26.0.0