What is CVE-2026-46395?

CVE-2026-46395 is a vulnerability in Haxtheweb Haxcms-nodejs, classified under Information Disclosure. Published 2026-06-05.

Is CVE-2026-46395 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Haxtheweb Haxcms-nodejs

CVE-2026-46395

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unaut…

Vulnerability class: Information Disclosure

EPSS: 0.003 (21.4th percentile) — read the EPSS interpretation.

Affected products

Haxtheweb Haxcms-nodejs — versions < 26.0.0

Weakness classification (CWE)

CWE-200 — Information Disclosure
CWE-321 — Use of Hard-coded Cryptographic Key
CWE-327 — Use of a Broken or Risky Cryptographic Algorithm

Public proof-of-concept exploits

shreyas-challa/CVE-2026-46395-haxcms-hmac-key-leak

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-46395?: CVE-2026-46395 is a vulnerability in Haxtheweb Haxcms-nodejs, classified under Information Disclosure. Published 2026-06-05.
Is CVE-2026-46395 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.