Skip to content
Threat Feed

Product

@Haxtheweb/Haxcms-Nodejs (<= 25.0.0)

1 brief RSS
critical advisory

HAXcms Node.js Backend Private Key Disclosure via Broken HMAC Implementation

The HAXcms Node.js backend contains two cryptographic implementation errors in the `hmacBase64()` function that allow an unauthenticated attacker to extract the system’s private signing key and forge arbitrary admin-level JSON Web Tokens (JWTs) allowing them to get full admin access with a single HTTP request.

@haxtheweb/haxcms-nodejs cve-2026-46395 haxcms key-disclosure jwt privilege-escalation
2r 1t