Is there a patch available for CVE-2026-46401?

Yes, a patch is available for CVE-2026-46401. Update the affected software to the latest version immediately.

HAX CMS CVE-2026-46401

Q: What is the CVSS score of CVE-2026-46401?

CVE-2026-46401 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34895 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-06-05 GitHub_M

PHP Authentication Bypass

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 21:52 vuln.today

Patch available

Jun 05, 2026 - 21:01 EUVD

CVSS changed

Jun 05, 2026 - 20:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 19:18 nvd

UNKNOWN (no severity yet)

DescriptionGitHub Advisory

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper session termination vulnerability where authentication tokens remain valid after user logout. This allows attackers who obtain valid tokens to maintain persistent access to authenticated CMS functionality, bypassing the intended session termination mechanism and enabling unauthorized access to CMS metadata and administrative functions. Version 26.0.0 fixes the issue.

AnalysisAI

Persistent session token access in HAX CMS (haxtheweb) prior to version 26.0.0 allows attackers who possess a valid authentication token to retain access to CMS administrative functions and metadata even after the legitimate user has logged out. The root cause is CWE-613 (Insufficient Session Expiration): authentication tokens are not invalidated server-side upon logout, meaning the session termination mechanism is cosmetic rather than functional. Both PHP and NodeJS backend deployments are affected. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the fix is available in version 26.0.0.

Technical ContextAI

HAX CMS is a microsite management platform with dual backend support (PHP and NodeJS), identified under CPE cpe:2.3:a:haxtheweb:issues. The vulnerability is classified as CWE-613 (Insufficient Session Expiration), a well-understood class of flaw where server-side session state is not properly destroyed upon logout. In a correctly implemented session lifecycle, the server should invalidate or revoke a token when a logout event is received, rendering it unusable for subsequent requests. In HAX CMS prior to 26.0.0, the logout operation does not trigger server-side token invalidation, meaning any bearer or session token captured before or during a session remains cryptographically valid and accepted by the server indefinitely. This affects authenticated CMS functionality including metadata access and administrative operations across both supported backend runtimes.

RemediationAI

The primary fix is upgrading HAX CMS to version 26.0.0 or later, which resolves the improper session termination by ensuring authentication tokens are invalidated server-side upon logout. The vendor advisory is available at https://github.com/haxtheweb/issues/security/advisories/GHSA-g5rc-4gpf-wx3w. If immediate upgrade is not feasible, a targeted compensating control is to enforce short token expiry times (e.g., 15-30 minutes of inactivity) at the application or reverse-proxy layer, which limits the window during which a stale token remains exploitable - note this does not fix the logout flaw but reduces persistence duration. Additionally, organizations can audit authentication logs for token reuse patterns following logout events to detect exploitation attempts. Rotating all active session secrets would force re-authentication across all sessions and invalidate existing tokens as a one-time remediation step, though this causes user disruption. The patch in 26.0.0 is the only confirmed full resolution.