HAX CMS EUVD-2026-34893

Exploitation requires three concrete conditions: (1) the attacker must have a network observation point on the path between the victim browser and the HAX CMS server (same Wi-Fi segment, switch-span access, ISP-level MITM, or compromised upstream router); (2) the victim must transmit at least one HTTP (not HTTPS) request to the HAX CMS origin while holding a valid haxcms_refresh_token, which happens on plaintext redirects, mixed-content loads, or direct http:// navigation; and (3) the deployment must be reachable over HTTP at all - sites that only listen on 443 and enforce HSTS preload effectively block the leak path even on vulnerable versions. The PR:N rating reflects that the attacker needs no credentials on the application itself, but the AV:N rating overstates accessibility because passive interception of a specific user's traffic is not equivalent to remote internet-wide reach.

Signals point in conflicting directions and the CVSS 4.0 score of 8.8 is likely overstated for typical deployments. The vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:L/VA:N) treats confidentiality impact as High and reachability as Network, but real-world exploitation requires the attacker to occupy a privileged network position (same LAN, ISP, or compromised upstream hop) AND for the victim to make at least one cleartext HTTP request to the HAX CMS origin - sites served strictly over HTTPS with HSTS are not realistically exploitable. CISA SSVC corroborates this nuance: Exploitation=none, Automatable=yes, Technical Impact=partial, which is consistent with a credential-leak primitive rather than direct RCE. No KEV listing and no public POC, and EPSS is not provided in the input. Practical prioritization: medium urgency - patch promptly because the fix is trivial, but the realistic threat is targeted MITM against users on hostile networks, not internet-wide mass exploitation.

A user on an untrusted network (coffee shop Wi-Fi, conference LAN, hostile ISP) authenticates to a HAX CMS site, then later triggers any cleartext HTTP request to the same origin - for example, typing the bare domain into the address bar without https://, clicking an http:// link, or loading a mixed-content resource. An attacker passively sniffing the segment captures the haxcms_refresh_token in the request headers and replays it from their own client to obtain a valid authenticated session as the victim. No public POC is required because the technique is generic cookie-sniffing well-documented in Firesheep-class tooling.