CVE-2025-54137: @haxtheweb/haxcms-nodejs Contains Hardcoded Default Credentials and JWT Keys
Summary
CVE-2025-54137: NodeJS version of the HAX CMS application is distributed with Default Secrets. Affects @haxtheweb/haxcms-nodejs versions < 11.0.10. Fixed in 11.0.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @haxtheweb/haxcms-nodejs package is a NodeJS implementation of the HAX CMS application, designed to facilitate the creation and management of web content. It provides a user-friendly interface and various features for content management. However, it has a critical security flaw that exposes users to potential unauthorized access due to hardcoded default credentials and private keys.
Vulnerability Detail
The vulnerability arises from the inclusion of hardcoded default credentials for user and superuser accounts, as well as default private keys for JSON Web Tokens (JWTs) within the application. Users are not prompted to change these credentials during installation, nor can they modify them through the user interface. This oversight allows unauthenticated attackers to easily access unconfigured self-hosted instances of the application, potentially leading to unauthorized modifications and further attacks.
How To Fix
Minimum fixed version
11.0.10
This is the first release that contains the fix.
npm install @haxtheweb/haxcms-nodejs@11.0.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the application until the package is updated. This can be done by implementing network-level security measures, such as firewalls or VPNs, to limit exposure to the application.
Conclusion
The vulnerability CVE-2025-54137 in the @haxtheweb/haxcms-nodejs package poses significant security risks due to hardcoded default credentials and JWT keys. It is crucial for users to update to the patched version and implement security measures to protect their applications.
See every vulnerability recorded for @haxtheweb/haxcms-nodejs →
FAQ
CVE-2025-54137 is a vulnerability in the @haxtheweb/haxcms-nodejs package that involves hardcoded default credentials and JWT keys, posing a security risk.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
An attacker can exploit this vulnerability to gain unauthorized access to the application, modify content, and potentially launch further attacks.
Yes, a patch is available in version 11.0.10 of the @haxtheweb/haxcms-nodejs package. It is recommended to update to this version.
If immediate updating is not possible, implement network security measures to restrict access to the application until the update can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for @haxtheweb/haxcms-nodejs.
