Executive brief
HAX CMS, a platform used to manage microsites, contains a security flaw where sensitive login information is sent over the network without proper encryption protections. An attacker on the same network could intercept this information to hijack a user's session and gain unauthorized access to the site management tools. This could lead to unauthorized content changes or administrative takeover of the affected microsites.
Technical details
A vulnerability exists in HAX CMS (specifically the haxcms-php package) where the 'haxcms_refresh_token' cookie is issued without the 'Secure' attribute. This occurs in the PHP backend within 'system/backend/php/lib/Operations.php'. Because the flag is missing, browsers may transmit the sensitive refresh token over unencrypted HTTP connections. A network-positioned attacker (e.g., via Man-in-the-Middle or packet sniffing on an open Wi-Fi) can capture this token to perform session hijacking. The issue is resolved in version 26.0.0 by explicitly setting the Secure flag to true in the setcookie function.
Affected products
- HAX the Web HAX CMS (haxcms-php) >=25.0.0, <26.0.0
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-05: disclosed: CVE published to NVD
- 2026-06-05: patched: Version 26.0.0 released