CVE-2026-46391: HAX CMS Auth Bypass Vulnerability

CVE-2026-46391 Overview

CVE-2026-46391 affects HAX CMS, a content management system that manages microsite environments using PHP or Node.js backends. The vulnerability resides in the @haxtheweb/open-apis package between version 9.0.1 and version 26.0.0. Multiple functions perform substring-only matching when validating hostnames before transmitting basic authorization headers. An attacker can craft a URL that appends the matched substring to an attacker-controlled domain and capture the credentials. The flaw is categorized under [CWE-183] Permissive List of Allowed Inputs. Version 26.0.0 contains the fix.

Critical Impact
Attackers can capture HTTP Basic Authentication credentials from @haxtheweb/open-apis clients by exploiting weak hostname validation, enabling unauthorized access to integrated upstream services.

Affected Products

HAX CMS @haxtheweb/open-apis versions 9.0.1 through versions prior to 26.0.0
HAX CMS deployments using the PHP backend that load the affected package
HAX CMS deployments using the Node.js backend that load the affected package

Discovery Timeline

2026-06-05 - CVE-2026-46391 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46391

Vulnerability Analysis

The vulnerability stems from improper hostname validation inside multiple functions in @haxtheweb/open-apis. The code checks whether an outbound request URL contains an allowlisted hostname as a substring rather than performing exact or structured hostname parsing. This logic mistakes hostnames like trusted.example.com.attacker.tld or attacker.tld/trusted.example.com for legitimate destinations. When the check passes, the package attaches HTTP Basic Authentication headers to the request. The attacker's endpoint then receives the Base64-encoded credentials. This pattern is a classic example of [CWE-183] where allow-list matching is too permissive.

Root Cause

The root cause is reliance on substring matching for hostname comparison. Secure validation requires parsing the URL, extracting the host component, and matching it against an exact allowlist or a strict suffix check anchored to the domain boundary. The affected functions skip this parsing step.

Attack Vector

An attacker registers or controls a domain that embeds a trusted substring. The attacker then induces the HAX CMS instance to issue a request to a URL containing the trusted substring while resolving to the attacker-controlled host. The package recognizes the substring, attaches basic authorization, and sends the credentials to the attacker. No authentication or user interaction is required to deliver the malicious URL when the request is generated through normal application flows.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-4fg7-f244-3j49 for technical details.

Detection Methods for CVE-2026-46391

Indicators of Compromise

Outbound HTTP requests from HAX CMS hosts to unexpected external domains carrying Authorization: Basic headers.
DNS resolutions from application servers to domains that contain embedded substrings of internal or trusted service hostnames.
Application logs showing @haxtheweb/open-apis requests to URLs that include trusted hostnames as path or subdomain components.

Detection Strategies

Inventory all HAX CMS deployments and identify any use of @haxtheweb/open-apis between versions 9.0.1 and 26.0.0.
Inspect egress proxy logs for requests carrying basic authorization headers to domains outside the approved integration list.
Hunt for URLs in application telemetry whose hostnames contain trusted strings followed by additional labels, such as trusted.example.com.*.

Monitoring Recommendations

Configure egress filtering and alert on outbound HTTPS requests from CMS servers to domains not present in an explicit allowlist.
Enable verbose logging on the @haxtheweb/open-apis request layer to record destination URLs prior to credential attachment.
Rotate any basic authentication credentials used by HAX CMS integrations and monitor upstream services for anomalous logins.

How to Mitigate CVE-2026-46391

Immediate Actions Required

Upgrade @haxtheweb/open-apis to version 26.0.0 or later across every HAX CMS deployment.
Rotate all HTTP Basic Authentication credentials configured for use with HAX CMS integrations.
Audit recent outbound traffic from HAX CMS servers for requests to unexpected hosts that carried authorization headers.

Patch Information

The maintainers released version 26.0.0 of @haxtheweb/open-apis to address the substring matching flaw. Refer to the GitHub Security Advisory GHSA-4fg7-f244-3j49 for the upstream patch and changelog details.

Workarounds

Restrict egress from HAX CMS servers using a proxy or firewall allowlist of exact destination hostnames.
Disable or remove integrations configured with HTTP Basic Authentication until the upgrade to 26.0.0 is completed.
Replace basic authentication with token-based authentication scoped to specific endpoints where the upstream service supports it.

bash

# Upgrade @haxtheweb/open-apis to the patched release
npm install @haxtheweb/open-apis@26.0.0

# Verify the installed version
npm ls @haxtheweb/open-apis