CVE-2026-46511: HAXcms Token Exposure and Cross-Tenant Hijacking Vulnerability
Summary
CVE-2026-46511: HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack. Affects @haxtheweb/haxcms-nodejs versions < 26.0.0. Fixed in 26.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
HAXcms is an open-source content management system designed for creating and managing web content. It allows users to build websites with ease, providing features such as user management, content editing, and API integrations. However, a critical vulnerability has been identified that exposes sensitive authentication tokens, making it susceptible to cross-tenant account takeover attacks.
Vulnerability Detail
The vulnerability arises from a combination of Stored XSS and improper handling of authentication tokens in the /system/api/connectionSettings endpoint. An authenticated attacker can exploit the Stored XSS to inject malicious scripts that fetch sensitive tokens from another user's session. This results in complete account takeover, allowing the attacker to perform unauthorized actions without needing the victim's password. The tokens exposed include jwt, user_token, site_token, and appstore_token, which are stored in a global JavaScript variable, window.appSettings.
How To Fix
Minimum fixed version
26.0.0
This is the first release that contains the fix.
npm install @haxtheweb/haxcms-nodejs@26.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that user input is properly sanitized and validated to prevent Stored XSS attacks. Additionally, avoid exposing sensitive tokens in global JavaScript variables. Implement Content Security Policy (CSP) headers to restrict the execution of scripts from untrusted sources.
Conclusion
CVE-2026-46511 represents a significant security risk for HAXcms users, exposing them to potential account hijacking through token exfiltration. It is crucial to update to the patched version 26.0.0 or later to safeguard against this vulnerability. Implementing additional security measures can further mitigate risks until an update can be applied.
See every vulnerability recorded for @haxtheweb/haxcms-nodejs →
FAQ
CVE-2026-46511 is a vulnerability in HAXcms that allows attackers to exfiltrate sensitive authentication tokens through Stored XSS, leading to cross-tenant account hijacking.
If you are using HAXcms version 25.0.0 or earlier, your installation is vulnerable. You can check your application's package-lock.json file or use Vulert to monitor for vulnerabilities.
Exploitation of this vulnerability can lead to total account hijacking, allowing attackers to perform malicious actions such as modifying user access or uploading harmful content.
Yes, you can implement input sanitization and Content Security Policy (CSP) headers as temporary measures to reduce the risk of exploitation.
Vulert is a monitoring tool that uses package-lock.json to alert users in real-time about open-source vulnerabilities in their software. You can check for vulnerabilities without signup using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for @haxtheweb/haxcms-nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
