Is CVE-2026-46391 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46391 being exploited in the wild.

How severe is CVE-2026-46391?

High severity, with a CVSS score of 4, published 5 June 2026.

Which products and versions are affected?

Haxtheweb HAX 9.0.1 through 25.x; fixed in 26.0.0; Haxtheweb Open-Apis < 26.0.0; @haxtheweb/open-apis (npm) < 26.0.0, SEMVER:introduced=0,fixed=26.0.0.

Is there a fix for CVE-2026-46391?

Yes. @haxtheweb/open-apis (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46391 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46391?

Check whether you run Haxtheweb HAX, Haxtheweb Open-Apis or @haxtheweb/open-apis (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46391: HAX the Web open-apis SSRF and credential theft via improper hostname matching

Q: Is there a fix for CVE-2026-46391?

Yes. @haxtheweb/open-apis (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46391 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46391?

Check whether you run Haxtheweb HAX, Haxtheweb Open-Apis or @haxtheweb/open-apis (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46391 · Severity: high · CVSS 4 · Published 2026-06-05

HAX open-apis is a Node.js library used to build web applications and learning management systems. The library improperly validates hostnames when sending HTTP requests with embedded credentials, allowing an attacker to craft malicious API calls that redirect authentication tokens to attacker-controlled servers. This enables theft of credentials that would grant access to internal systems and unreleased educational content.

Vendors: Haxtheweb, npm.

Quick answers

Is CVE-2026-46391 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46391 being exploited in the wild.
How severe is CVE-2026-46391?: High severity, with a CVSS score of 4, published 5 June 2026.
Which products and versions are affected?: Haxtheweb HAX 9.0.1 through 25.x; fixed in 26.0.0; Haxtheweb Open-Apis < 26.0.0; @haxtheweb/open-apis (npm) < 26.0.0, SEMVER:introduced=0,fixed=26.0.0.
Is there a fix for CVE-2026-46391?: Yes. @haxtheweb/open-apis (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46391 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46391?: Check whether you run Haxtheweb HAX, Haxtheweb Open-Apis or @haxtheweb/open-apis (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@haxtheweb/open-apis (npm): upgrade to 26.0.0 or later
```
npm install @haxtheweb/open-apis@26.0.0
```

Technical details

The vulnerability exists in three API endpoint handlers that perform inadequate hostname validation before sending HTTP requests with Basic Authentication credentials. Instead of exact hostname matching, the code performs substring matching (checking if a hard-coded domain name appears anywhere in a user-controlled URL parameter), which allows bypass by prepending or appending the substring to an attacker-controlled domain. An unauthenticated attacker can craft API calls with a malicious URL parameter containing the vulnerable substring, causing the application to send HTTP requests with embedded credentials to the attacker's server. The attack is network-reachable with no authentication or user interaction required. Patches are available in version 26.0.0 and later.

Affected products

HAX @haxtheweb/open-apis 9.0.1 through 25.x; fixed in 26.0.0

Identifiers

CVE-2026-46391
GHSA-4fg7-f244-3j49

Timeline

2026-05-19: disclosed: GHSA-4fg7-f244-3j49 published
2026-06-05: other: NVD published CVE-2026-46391
2026-05-19: patched: Patch available in version 26.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.