CVE-2025-54137: HAX CMS NodeJS Auth Bypass Vulnerability

CVE-2025-54137 Overview

CVE-2025-54137 affects HAX CMS NodeJS, a content management system that lets users manage microsite universes with a NodeJS backend. Versions 11.0.9 and earlier shipped with hardcoded default credentials for both the user and superuser accounts. The same releases also bundled default private keys used to sign JSON Web Tokens (JWTs). The application does not prompt operators to rotate these secrets during installation, and the user interface offers no mechanism to change them. An unauthenticated attacker can retrieve these values directly from the public haxtheweb GitHub repositories and authenticate against any unconfigured self-hosted instance. The issue is resolved in version 11.0.10.

Critical Impact
Unauthenticated attackers can log in as administrators on default HAX CMS NodeJS deployments, modify hosted sites, and forge valid JWTs using the publicly disclosed private keys.

Affected Products

HAX CMS NodeJS versions 11.0.9 and below
Self-hosted HAX CMS NodeJS deployments without manual credential rotation
HAX CMS NodeJS instances using the bundled JWT private keys

Discovery Timeline

2025-07-22 - CVE-2025-54137 published to the National Vulnerability Database
2025-08-22 - Last updated in NVD database

Technical Details for CVE-2025-54137

Vulnerability Analysis

The weakness is classified under [CWE-1392] Use of Default Credentials. HAX CMS NodeJS initializes the application with a hardcoded admin/admin account when no user configuration file exists. The same code path provisions default JWT signing keys when a key file is missing. Because both the source code and the default values live in the public haxtheweb GitHub organization, the secrets carry no entropy advantage for the operator. Attackers can clone the repository, read the defaults, and authenticate immediately against any internet-exposed instance that has not been hardened post-install.

Root Cause

The root cause is the absence of a forced credential and key rotation step during the application bootstrap process. The constructor logic in src/lib/HAXCMS.js writes static admin credentials to a .user file and generates predictable defaults when configuration files are missing. Operators receive only a console warning rather than an enforced prompt, and the UI exposes no path to update the secrets.

Attack Vector

Attackers do not require network adjacency, authentication, or user interaction. The attack proceeds in four steps. First, the attacker locates a HAX CMS NodeJS instance through scanning or fingerprinting. Second, they retrieve the default admin credentials from the public source tree. Third, they authenticate to the management endpoints and receive a session token. Fourth, they can forge arbitrary JWTs using the disclosed private key to escalate or persist access, modify hosted microsites, and pivot to further attacks.

javascript

// Patch excerpt from src/lib/HAXCMS.js introducing default-user creation with explicit warnings
this.refreshPrivateKey = uuidv4();
fs.writeFileSync(path.join(this.configDirectory, ".rpk"), this.refreshPrivateKey);
}
// allow for loading in user defined config
// pk/rpk test for files that can contain these
try {
  this.user = JSON.parse(fs.readFileSync(path.join(this.configDirectory, ".user")),
  {encoding:'utf8', flag:'r'}, 'utf8');
  this.superUser = {...this.user};
}
catch (e) {
  console.warn('***************************************************************');
  console.warn('\nHAXcms USER CONFIGURATION FILE NOT FOUND, creating default user');
  console.warn(`${path.join(this.configDirectory, ".user")} is being created with default credentials`);
  console.warn("MAKE SURE YOU EDIT THIS FILE IF PUTTING IN PRODUCTION!!!!!");
  console.warn("username: admin");
  console.warn("password: admin");
  console.warn("\n***************************************************************");
  // create a default user
  this.superUser = {
    name: 'admin',
    password: 'admin',
  };
  this.user = {
    name: 'admin',
    password: 'admin',
  };
  fs.writeFileSync(path.join(this.configDirectory, ".user"), JSON.stringify(this.user, null, 2));
}
// warn if we have default credentials

Source: haxcms-nodejs commit 6dc2441

Detection Methods for CVE-2025-54137

Indicators of Compromise

Successful authentication events using the username admin against HAX CMS NodeJS administrative endpoints from unexpected source IPs.
Presence of a .user file in the HAX CMS configuration directory containing the default admin/admin JSON payload.
JWT tokens validated against the default private keys shipped in the public haxtheweb repositories.
Unexpected creation, deletion, or modification of microsites in HAX CMS audit logs.

Detection Strategies

Compare the deployed version string against 11.0.10 to flag vulnerable installations.
Hash and compare the .pk, .rpk, and .user files against the upstream defaults committed to the public repository.
Alert on administrative API calls originating from IP ranges not associated with operator workstations.

Monitoring Recommendations

Forward HAX CMS application logs to a centralized log platform and alert on repeated successful logins for admin shortly after deployment.
Monitor outbound network requests from the HAX CMS host for indicators of post-exploitation tooling or webshell staging.
Track changes to files under the HAX CMS configDirectory, especially .user, .pk, and .rpk.

How to Mitigate CVE-2025-54137

Immediate Actions Required

Upgrade HAX CMS NodeJS to version 11.0.10 or later, which prompts operators to rotate defaults.
Rotate the admin and superuser passwords on every existing deployment, including non-production instances.
Regenerate the JWT private keys (.pk) and refresh private keys (.rpk) and invalidate any tokens issued before rotation.
Audit recent administrative activity for unauthorized site modifications or new accounts.

Patch Information

The fix is delivered in HAX CMS NodeJS version 11.0.10. The patch is implemented in src/lib/HAXCMS.js and is detailed in the GitHub Security Advisory GHSA-5fpv-5qvh-7cf3 and the upstream commit 6dc2441.

Workarounds

Restrict network access to HAX CMS NodeJS administrative endpoints using firewall rules or a reverse proxy with IP allowlists until patching is complete.
Manually overwrite the .user, .pk, and .rpk files in the configuration directory with strong, unique values before exposing the instance.
Place HAX CMS NodeJS behind an authenticating reverse proxy to add a second authentication factor.

bash

# Example: rotate HAX CMS defaults before exposing the instance
CONFIG_DIR="/path/to/haxcms/config"

# Replace default admin credentials
cat > "$CONFIG_DIR/.user" <<EOF
{
  "name": "$(openssl rand -hex 8)",
  "password": "$(openssl rand -base64 24)"
}
EOF

# Regenerate JWT private key and refresh private key
openssl rand -hex 32 > "$CONFIG_DIR/.pk"
openssl rand -hex 32 > "$CONFIG_DIR/.rpk"

chmod 600 "$CONFIG_DIR/.user" "$CONFIG_DIR/.pk" "$CONFIG_DIR/.rpk"