CVE-2026-46493: HAX CMS Weak Salt Generation Vulnerability

CVE-2026-46493 Overview

CVE-2026-46493 is a cryptographic weakness in HAX CMS, an open-source platform that manages microsite ecosystems with PHP or Node.js backends. Versions prior to 26.0.1 generate cryptographic salts using PHP's uniqid function, which produces predictable, time-based values unsuitable for security contexts. An unauthenticated network attacker can predict or brute-force the resulting salts and compromise the confidentiality of protected data. The issue is classified under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator. HAX CMS version 26.0.1 resolves the vulnerability by replacing uniqid with random_bytes.

Critical Impact
Predictable salts allow remote attackers to reverse or replicate secrets generated by HAX CMS, undermining the confidentiality of authentication artifacts and stored credentials.

Affected Products

HAX CMS PHP backend (haxcms-php) versions prior to 26.0.1
HAX CMS Node.js backend versions prior to 26.0.1
HAX CMS microsite deployments using affected install.php salt generation

Discovery Timeline

2026-06-05 - CVE-2026-46493 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-46493

Vulnerability Analysis

The vulnerability resides in the HAX CMS installer logic, where the application generated cryptographic salts using uniqid. PHP's uniqid derives its output from the current microsecond timestamp and is not designed for security-sensitive operations. An attacker who can observe or approximate the installation time can enumerate the candidate salt space within seconds.

Because the salt is consumed during account or secret initialization, predictable output weakens any downstream cryptographic operation that depends on its uniqueness. The flaw is remotely reachable over the network, requires no authentication, and no user interaction.

Root Cause

The root cause is the use of a non-cryptographic pseudo-random source for security-critical material. uniqid returns a hex representation of the current Unix time plus microseconds and offers no entropy guarantees. Mapping CWE-338 to this implementation confirms the misuse of a weak PRNG for salt generation.

Attack Vector

A remote attacker targets a HAX CMS instance and infers the approximate installation window through HTTP headers, deployment metadata, or repository timestamps. The attacker then iterates plausible microsecond values to regenerate the salt locally and replay it against protected artifacts.

php

<?php
  include_once 'system/backend/php/lib/Git.php';
  // add git library
+ $generateSecureSecret = function () {
+   $parts = array();
+   for ($i = 0; $i < 4; $i++) {
+     $parts[] = bin2hex(random_bytes(16));
+   }
+   return implode('-', $parts);
+ };
  if (!is_dir('_config')) {
    // gotta config some place now don't we
    if (!mkdir('_config')) {

Source: HAX CMS Security Patch Commit. The patch replaces predictable uniqid output with four 16-byte segments produced by random_bytes, a cryptographically secure source.

Detection Methods for CVE-2026-46493

Indicators of Compromise

Presence of HAX CMS install.php referencing uniqid for salt generation in deployed instances
HAX CMS deployments running versions earlier than 26.0.1 with original _config artifacts intact
Repeated authentication or token-validation requests from a single source targeting /install.php or session endpoints

Detection Strategies

Inventory HAX CMS installations and compare deployed code against the patched commit 4b83cbdf8782c75bdcdd4f57ba72fba1c6dac147
Scan PHP source for calls to uniqid used in security contexts and flag any matches in CMS or authentication code paths
Correlate web access logs for enumeration patterns against installer or session endpoints over short time windows

Monitoring Recommendations

Alert on unauthenticated requests to HAX CMS administrative or installer routes from external sources
Track integrity of _config directories and salt files to detect tampering or replay activity
Forward HAX CMS web server and application logs to a centralized analytics platform for retroactive hunting

How to Mitigate CVE-2026-46493

Immediate Actions Required

Upgrade all HAX CMS instances to version 26.0.1 or later without delay
Rotate any secrets, tokens, or credentials generated by vulnerable installations
Restrict network exposure of HAX CMS installer endpoints until the upgrade completes

Patch Information

The maintainers fixed the issue in HAX CMS 26.0.1. The corrective change replaces uniqid with bin2hex(random_bytes(16)) to produce cryptographically secure salts. Review the GitHub Security Advisory GHSA-xg43-xm47-74cp and apply the patched release from the haxcms-php repository.

Workarounds

Block external access to HAX CMS installer paths via web server or reverse proxy rules until patching is complete
Manually replace uniqid-based salt generation with random_bytes in self-hosted forks if an immediate upgrade is not possible
Regenerate any persisted secrets after applying the fix to invalidate predictable values

bash

# Upgrade HAX CMS PHP backend to the patched release
composer require haxtheweb/haxcms-php:^26.0.1

# Verify the fix is present in install.php
grep -n "random_bytes" install.php