CVE-2026-46391: HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-05 · updated 2026-10-26
Weakness: CWE-183

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.

Affected products

haxtheweb @haxtheweb/open-apis: from 9.0.1, < 26.0.0

References

https://github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49
https://github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49

Get alerted when CVE-2026-46391 or the next vulnerability affects your stack