# CVE-2026-46401: haxtheweb HAX CMS insufficient session expiration

Source: https://junglewise.ai/threats/cve-2026-46401-haxtheweb-hax-cms-insufficient-session-expiration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-46401 · Severity: info · CVSS 5.3 · Published 2026-06-05

HAX CMS is a content management system used to build and manage microsites. A security flaw in its logout process means that when a user logs out, their session token is not actually deactivated on the server. If an attacker manages to obtain a user's session token, they can continue to access administrative functions and site data even after the legitimate user has ended their session.

Technologies: [Haxtheweb HAX CMS](https://junglewise.ai/threats/technologies/hax-cms). Vendors: [Haxtheweb](https://junglewise.ai/threats/vendors/haxtheweb).

## Quick answers

**Is CVE-2026-46401 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46401 being exploited in the wild.

**How severe is CVE-2026-46401?** Informational severity, with a CVSS score of 5.3, published 5 June 2026.

**Which products and versions are affected?** Haxtheweb HAX CMS < 26.0.0.

**Is there a fix for CVE-2026-46401?** A patch was published on 2026-06-05: Version 26.0.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46401 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46401?** Check whether you run Haxtheweb HAX CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

HAX CMS (specifically the haxcms-php package) fails to implement server-side session invalidation. While the logout function clears the client-side state, the server does not blacklist or revoke the 'user_token' associated with the session. An attacker with access to a previously valid token can replay it against authenticated API endpoints (such as /system/api/getSkeleton or /system/api/getSites) to maintain persistent access. The vulnerability is classified as CWE-613 (Insufficient Session Expiration) and is resolved in version 26.0.0 by implementing proper server-side token revocation.

## Affected products

- haxtheweb HAX CMS (haxcms-php) < 26.0.0

## Timeline

- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-05: disclosed: NVD publication date
- 2026-06-05: patched: Version 26.0.0 released to address the issue

## References

- [https://github.com/haxtheweb/issues/security/advisories/GHSA-g5rc-4gpf-wx3w](https://github.com/haxtheweb/issues/security/advisories/GHSA-g5rc-4gpf-wx3w)

## Related threats

- [haxtheweb HAX CMS weak PRNG for salts in install.php](https://junglewise.ai/threats/cve-2026-46493-haxtheweb-hax-cms-weak-prng-for-salts-in-install-php)
- [haxtheweb HAX CMS denial of service in createSite endpoint](https://junglewise.ai/threats/cve-2026-46357-haxtheweb-hax-cms-denial-of-service-in-createsite-endpoint)
- [haxtheweb HAX CMS stored XSS in video-player component](https://junglewise.ai/threats/cve-2026-46496-haxtheweb-hax-cms-stored-xss-in-video-player-component)
- [haxtheweb HAX CMS authenticated RCE via file overwrite in saveOutline](https://junglewise.ai/threats/cve-2026-46399-haxtheweb-hax-cms-authenticated-rce-via-file-overwrite-in)
- [HAX CMS stored XSS in iframe elements](https://junglewise.ai/threats/cve-2026-46396-hax-cms-stored-xss-in-iframe-elements)