---
title: "CVE-2026-46395: HAXcms: Private Key Disclosure via Broken HMAC Implementation"
url: https://erroneo.us/security/cve/CVE-2026-46395/
description: "CVE-2026-46395 (@haxtheweb/haxcms-nodejs (npm)): HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-06-05
date_modified: 2026-06-09
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-46395"
kev: false
cvss: 9.3
epss: 0.00287
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-46395: HAXcms: Private Key Disclosure via Broken HMAC Implementation

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.3% , percentile 20: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 20% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes @haxtheweb/haxcms-nodejs (npm) <= 25.0.0, fixed in 26.0.0 . Check your lockfile, including transitive dependencies.

## What it is

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the hmacBase64() function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing key and forge arbitrary admin-level JSON Web Tokens (JWTs) allowing them to get full admin access with a single HTTP request. First, the function passes the literal string "0" as the HMAC signing key instead of the key parameter, making every HAXcms instance compute identical HMACs for the same input. Then, after computing the HMAC, the function concatenates the real key parameter which is "this.privateKey + this.salt", the system’s master signing secret is directly onto the output. The combined buffer is base64-encoded and returned as the token. Every base64url token produced has the same structure: 32 bytes HMAC keyed with "0" and N bytes of privateKey+salt. An attacker base64-decodes any token, discards the first 32 bytes, and reads the private key directly. The /system/api/connectionSettings endpoint is unauthenticated and returns multiple tokens generated by this function. A single GET request to this endpoint exposes the private key. The PHP backend implements this function correctly with the actual key and returns only the hash. The PHP version produces 44-character tokens whereas the broken Node.js version produces 139+ character tokens. Version 26.0.0 fixes the issue.

## Affected packages

- npm `@haxtheweb/haxcms-nodejs` <= 25.0.0 → fixed: 26.0.0

## Affected products (CVE record)

- haxtheweb haxcms-nodejs: < 26.0.0

## Severity

- GitHub_M CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
- GitHub CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.29% probability of exploitation activity in the next 30 days; percentile 20.

## Sources

- [GitHub Advisory GHSA-6c8g-9hfh-pq5h](https://github.com/advisories/GHSA-6c8g-9hfh-pq5h)
- [CVE.org record CVE-2026-46395](https://www.cve.org/CVERecord?id=CVE-2026-46395)
- [NVD entry CVE-2026-46395](https://nvd.nist.gov/vuln/detail/CVE-2026-46395)
- [github.com](https://github.com/haxtheweb/issues/security/advisories/GHSA-6c8g-9hfh-pq5h)

---
Source page: https://erroneo.us/security/cve/CVE-2026-46395/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt