HAX open-apis EUVD-2026-34882

Exploitation requires only network reachability to a deployed instance of @haxtheweb/open-apis (version < 26.0.0) that exposes the affected endpoints backed by cacheAddress.js, JOSHelpers.js, or elmslnToSite.js, and a target URL parameter the attacker can influence; no authentication, no user interaction, and no non-default configuration is needed since the vulnerable substring-matching logic is present in the default code path. The practical limiting factor is the relatively narrow deployment footprint (HAX/HAXcms operators) and the fact that the leaked secret is only as valuable as the hard-coded upstream credentials configured in that specific deployment - instances that never configured Basic auth for the hard-coded domains have nothing to leak.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N yields 8.7 (High) and matches the reported behavior: network-reachable, no authentication, no user interaction, high confidentiality impact, with a subsequent low confidentiality impact on downstream systems whose credentials are leaked. There is no CISA KEV listing and no EPSS score was supplied, so this is no public exploit identified at time of analysis in terms of active in-the-wild use, but a detailed proof-of-concept with screenshots is published in the GHSA advisory, so publicly available exploit code exists at the conceptual level. The real-world blast radius is bounded by the size of the @haxtheweb/open-apis deployment footprint - primarily HAXcms hosts used in educational settings - rather than mass-internet scale, so prioritize patching wherever this package is deployed but treat the population-level urgency as moderate. The SSVC technical impact is partial (credential exfiltration, not RCE), but automatability is high because the request can be issued in a single crafted API call.

An attacker enumerates HAXcms / open-apis endpoints reachable on the internet, then issues an API call (e.g., to the cacheAddress route) supplying a target URL such as https://trusted-haxsite.attacker.com/ or https://attacker.com/?trusted-haxsite that contains the hard-coded substring the server checks for. The server's substring validator passes, the server-side HTTP client appends the Basic Authorization header intended for the legitimate hard-coded domain, and the attacker's listener (per the published PoC, fronted by a Cloudflare tunnel) captures the credentials, which the maintainer confirmed grant access to unreleased LMS content on downstream systems.