Detections
Analytics

SCA: security update for @haxtheweb/haxcms-nodejs (GHSA-6c8g-9hfh-pq5h)

critical Tenable Cloud Security Plugin ID 442166

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the
 `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation
 errors that together allow any unauthenticated attacker to extract the system’s private signing key and
 forge arbitrary admin-level JSON Web Tokens (JWTs) allowing them to get full admin access with a single
 HTTP request. First, the function passes the literal string "0" as the HMAC signing key instead of the key
 parameter, making every HAXcms instance compute identical HMACs for the same input. Then, after computing
 the HMAC, the function concatenates the real key parameter which is "this.privateKey + this.salt", the
 system’s master signing secret is directly onto the output. The combined buffer is base64-encoded and
 returned as the token. Every base64url token produced has the same structure: 32 bytes HMAC keyed with "0"
 and N bytes of `privateKey+salt`. An attacker base64-decodes any token, discards the first 32 bytes, and
 reads the private key directly. The `/system/api/connectionSettings` endpoint is unauthenticated and
 returns multiple tokens generated by this function. A single GET request to this endpoint exposes the
 private key. The PHP backend implements this function correctly with the actual key and returns only the
 hash. The PHP version produces 44-character tokens whereas the broken Node.js version produces 139+
 character tokens. Version 26.0.0 fixes the issue. (CVE-2026-46395)

Solution

Update the @haxtheweb/haxcms-nodejs library and its related packages to version 26.0.0 or later.

See Also

https://github.com/advisories/GHSA-6c8g-9hfh-pq5h

Plugin Details

Severity: Critical

ID: 442166

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 5/19/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.76

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-46395

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/19/2026

Vulnerability Publication Date: 5/19/2026

Reference Information

CVE: CVE-2026-46395