Executive brief
HAX CMS is a platform used to create and manage collections of small websites (microsites). A security flaw allows a logged-in user to steal the digital 'keys' of other users, including administrators, by tricking their web browser into revealing secret session tokens. If successful, an attacker can take over other accounts, modify or delete websites, and access sensitive data without needing a password.
Technical details
HAX CMS (PHP and Node.js versions) prior to 26.0.0 contains a vulnerability where the `/system/api/connectionSettings` endpoint leaks active session authentication tokens (JWT, user_token, site_token, and appstore_token) into the global JavaScript variable `window.appSettings`. By leveraging a Stored XSS vulnerability (e.g., via malicious iframes or video-player tags), an authenticated attacker can execute a script in a victim's browser. This script fetches the victim's connection settings—automatically authenticated by the browser's session cookies—extracts the tokens, and exfiltrates them to an external webhook. This allows the attacker to bypass authentication and perform administrative actions as the victim. The issue is resolved in version 26.0.0.
Affected products
- HAX the Web haxcms-nodejs <= 25.0.0
- HAX the Web haxcms-php <= 25.0.0
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-05: disclosed: CVE published to NVD