What is CVE-2026-46391?

CVE-2026-46391 is a vulnerability in Haxtheweb @Haxtheweb/open-apis, classified under CWE-183. Published 2026-06-05.

Is CVE-2026-46391 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SSRF in Haxtheweb @Haxtheweb/open-apis

CVE-2026-46391

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic aut…

EPSS: 0.005 (36.9th percentile) — read the EPSS interpretation.

Affected products

Haxtheweb @Haxtheweb/open-apis — versions >= 9.0.1, < 26.0.0

Weakness classification (CWE)

CWE-183
CWE-918 — Server-Side Request Forgery (SSRF)

Public proof-of-concept exploits

bradyjmcl/cve-2026-46391

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-46391?: CVE-2026-46391 is a vulnerability in Haxtheweb @Haxtheweb/open-apis, classified under CWE-183. Published 2026-06-05.
Is CVE-2026-46391 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.