CVE-2026-46391CWE-183CWE-918

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

High · published June 5, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
45.0
In the wild
Unconfirmed
What it is

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00546 · 45.0th percentile
Weaknesses
CWE-183 · Permissive List of Allowed Inputs; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-05T18:18Z
EPSS history
Timeline
  • 05 JUN 18:18Z
    HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
    cvelistv5