HAX CMS CVE-2026-46401

The attacker must first obtain a valid authentication token issued to a legitimate HAX CMS user - this is the primary limiting condition and requires a prior token theft or interception step (e.g., via network sniffing, log exposure, or stolen browser session). The vulnerability is then triggered after the legitimate user logs out: the server continues to accept the captured token, bypassing the intended session termination. The CVSS PR:L metric confirms low-level authenticated context is required, meaning unauthenticated remote exploitation is not possible. Exploitation is limited to confidentiality impact (CMS metadata and admin function access) with no integrity or availability impact per the CVSS vector (VC:L/VI:N/VA:N). Both PHP and NodeJS backend deployments are susceptible; no specific non-default configuration is required for the flaw to be present - it affects all installations running versions prior to 26.0.0.

The CVSS 4.0 score of 5.3 reflects moderate severity. The vector AV:N/AC:L/AT:N/PR:L/UI:N indicates the attack is network-reachable with low complexity and no user interaction, but critically requires PR:L (low privileges), meaning an attacker must first possess a valid authentication token - this is a non-trivial prerequisite that meaningfully limits opportunistic exploitation. The confidentiality impact is limited to VC:L with no integrity or availability impact, consistent with unauthorized read access to CMS metadata and admin functions rather than full system compromise. No EPSS data was provided in the intelligence sources, which limits probabilistic exploitation forecasting. There is no CISA KEV listing and no public exploit code identified, suggesting this is not currently being exploited at scale. The realistic risk profile is: elevated for organizations where session tokens may be exposed via logs, proxies, or browser history, but not a critical emergency requiring emergency patching - a standard patch cycle is appropriate given the authenticated prerequisite and low impact scope.

An attacker who intercepts or obtains a valid HAX CMS session token - for example, through network traffic inspection on an unencrypted connection, browser history exposure, or log file access - can replay that token in authenticated API requests after the legitimate user has logged out. Because the server does not invalidate the token on logout, the attacker retains access to CMS metadata and administrative functionality for an indefinite period. No public exploit code is identified at time of analysis, but the attack requires no special tooling beyond a standard HTTP client capable of replaying bearer tokens.