Is CVE-2026-46401 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46401 being exploited in the wild.

How severe is CVE-2026-46401?

Informational severity, with a CVSS score of 5.3, published 5 June 2026.

Is there a fix for CVE-2026-46401?

A patch was published on 2026-06-05: Version 26.0.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46401 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46401?

Check whether you run Haxtheweb HAX CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46401: haxtheweb HAX CMS insufficient session expiration

CVE-2026-46401 · Severity: info · CVSS 5.3 · Published 2026-06-05

HAX CMS is a content management system used to build and manage microsites. A security flaw in its logout process means that when a user logs out, their session token is not actually deactivated on the server. If an attacker manages to obtain a user's session token, they can continue to access administrative functions and site data even after the legitimate user has ended their session.

Technologies: Haxtheweb HAX CMS. Vendors: Haxtheweb.

Quick answers

Is CVE-2026-46401 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46401 being exploited in the wild.
How severe is CVE-2026-46401?: Informational severity, with a CVSS score of 5.3, published 5 June 2026.
Which products and versions are affected?: Haxtheweb HAX CMS < 26.0.0.
Is there a fix for CVE-2026-46401?: A patch was published on 2026-06-05: Version 26.0.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46401 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46401?: Check whether you run Haxtheweb HAX CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

HAX CMS (specifically the haxcms-php package) fails to implement server-side session invalidation. While the logout function clears the client-side state, the server does not blacklist or revoke the 'user_token' associated with the session. An attacker with access to a previously valid token can replay it against authenticated API endpoints (such as /system/api/getSkeleton or /system/api/getSites) to maintain persistent access. The vulnerability is classified as CWE-613 (Insufficient Session Expiration) and is resolved in version 26.0.0 by implementing proper server-side token revocation.

Affected products

haxtheweb HAX CMS (haxcms-php) < 26.0.0

Timeline

2026-05-12: advisory: GitHub Security Advisory published
2026-06-05: disclosed: NVD publication date
2026-06-05: patched: Version 26.0.0 released to address the issue

References

https://github.com/haxtheweb/issues/security/advisories/GHSA-g5rc-4gpf-wx3w

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.