CVE-2026-46496: HAX CMS Stored XSS Vulnerability

CVE-2026-46496 Overview

CVE-2026-46496 is a stored cross-site scripting (XSS) vulnerability in HAX CMS, a content management system that manages microsite ecosystems using PHP or Node.js backends. The flaw resides in the <video-player> component, which fails to sanitize javascript: URIs supplied through the source attribute. When a victim views an affected page, the embedded script executes in the browser context. Attackers can steal JSON Web Tokens (JWTs), hijack sessions, and access sensitive user data. The issue is tracked under [CWE-79] and affects all versions prior to 26.0.0.

Critical Impact

Authenticated attackers can store malicious javascript: payloads in the <video-player> component, leading to arbitrary script execution and JWT token theft in any user's browser session.

Affected Products

• HAX CMS (PHP backend) versions prior to 26.0.0
• HAX CMS (Node.js backend) versions prior to 26.0.0
• HAX <video-player> web component

Discovery Timeline

• 2026-06-05 - CVE-2026-46496 published to NVD
• 2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-46496

Vulnerability Analysis

The vulnerability is a stored XSS flaw rooted in improper input validation within the <video-player> web component. The component accepts a source attribute intended to reference a video URL. However, it does not validate the URI scheme before rendering. An attacker with content authoring privileges can supply a javascript: URI as the source value. When the component initializes in a victim's browser, the payload executes in the page origin.

Because HAX CMS persists component configurations, the malicious payload remains in storage and triggers for every user who loads the affected microsite page. The script runs with full access to the Document Object Model (DOM), browser storage, and any authentication material accessible to JavaScript. Stolen JWT tokens enable session impersonation and lateral movement across the HAX CMS administrative surface.

Root Cause

The root cause is missing URI scheme validation on the source attribute of the <video-player> component. Safe handling requires allowlisting protocols such as https: and data:video/* while rejecting javascript:, vbscript:, and other executable schemes. HAX CMS 26.0.0 introduces this sanitization logic.

Attack Vector

Exploitation requires low-privilege authenticated access to create or edit content containing a <video-player> element. The attacker sets the source attribute to a javascript: URI carrying the payload. Any user who later views the page triggers script execution, including administrators. User interaction is limited to viewing the affected content. See the GitHub Security Advisory GHSA-2m6p-hm3w-6jm3 for technical details on the vulnerable component.

Detection Methods for CVE-2026-46496

Indicators of Compromise

• Stored content containing <video-player> elements with source attributes beginning with javascript:, vbscript:, or data:text/html
• Outbound HTTP requests from browser sessions to attacker-controlled domains carrying JWT tokens or cookies in query strings or POST bodies
• Unexpected administrator session activity originating from new IP addresses shortly after content is viewed
• HAX CMS audit log entries showing content edits to pages immediately followed by anomalous authentication events

Detection Strategies

• Scan the HAX CMS content store and database for component definitions whose attributes contain the string javascript: or URL-encoded variants such as javascript%3A
• Deploy Content Security Policy (CSP) reporting in Report-Only mode to surface inline script execution attempts originating from component attributes
• Inspect web server access logs for requests to administrative endpoints from sessions that loaded pages containing user-generated <video-player> content

Monitoring Recommendations

• Enable verbose logging for content authoring APIs and forward events to a centralized SIEM for correlation with authentication telemetry
• Monitor JWT issuance and consumption patterns for tokens used from multiple geographies or user agents within short time windows
• Alert on browser console errors and CSP violations reported by end-user telemetry, which often indicate XSS execution attempts

How to Mitigate CVE-2026-46496

Immediate Actions Required

• Upgrade HAX CMS to version 26.0.0 or later, which sanitizes the <video-player>source attribute
• Audit existing stored content for <video-player> elements containing javascript: URIs and remove or rewrite them
• Rotate all active JWT signing keys and invalidate existing sessions to revoke any tokens potentially stolen prior to patching
• Review administrator and editor accounts for unauthorized changes made between the vulnerability introduction and remediation

Patch Information

HAX CMS version 26.0.0 fixes the vulnerability by validating URI schemes in the <video-player> component. Refer to the GitHub Security Advisory GHSA-2m6p-hm3w-6jm3 for the official advisory and patch notes.

Workarounds

• Enforce a strict Content Security Policy that disallows inline script execution and javascript: URIs, for example script-src 'self'; object-src 'none'
• Restrict content authoring permissions to trusted users until the upgrade to 26.0.0 is completed
• Place a web application firewall (WAF) rule in front of HAX CMS to block POST requests containing javascript: patterns within source attribute values

# Example CSP header to mitigate stored XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;