{"id":"CVE-2026-46391","aliases":["EUVD-2026-34882","GHSA-4fg7-f244-3j49"],"status":"published","title":"HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00457,"percentile":0.40094,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-183","CWE-918"],"published":"2026-05-19T14:44:46Z","modified":"2026-10-26T11:10:00Z","exploits":[{"source":"pocgithub","id":"bradyjmcl/cve-2026-46391","title":"bradyjmcl/cve-2026-46391","date":"2026-05-14","url":"https://github.com/bradyjmcl/cve-2026-46391"}],"fixes":[{"ecosystem":"npm","package":"@haxtheweb/open-apis","fixed_in":["26.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@haxtheweb/open-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@haxtheweb/open-apis","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"26.0.0"}]}]}],"products":[{"vendor":"haxtheweb","product":"@haxtheweb/open-apis"}],"references":[{"url":"https://github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49","tags":["x_refsource_CONFIRM","exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46391","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4fg7-f244-3j49"},{"url":"https://github.com/haxtheweb/issues","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-46391","title":"HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.","status":"published","published":"2026-06-05T18:18:42.028Z","modified":"2026-06-08T16:18:38.404Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-183","CWE-918"],"updated_at":"2026-11-02T13:47:06.353366Z"}],"euvd":[{"id":"EUVD-2026-34882","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.","status":"published","published":"2026-06-05T18:18:42Z","modified":"2026-06-08T16:18:38Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:48.834104Z"}],"ghsa":[{"id":"GHSA-4fg7-f244-3j49","title":"HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis","description":"### Summary\nMultiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication.\n\n### Details\n[api/services/website/cacheAddress.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/services/website/cacheAddress.js#L21), [api/apps/haxcms/lib/JOSHelpers.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/lib/JOSHelpers.js#L26), and [api/apps/haxcms/convert/elmslnToSite.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/convert/elmslnToSite.js#L37) use similar logic to check for hard-coded site names. However, the logic only looks for the substring to be included in the user-controlled string, allowing an attacker to craft an API call and extract the credentials intended for the hard-coded domains.\n\n### PoC\nMaking API calls to an affected endpoint will result in credential theft. The attacker-controlled domains in these proofs of concept are `cloudflared` tunnels, protecting the production credentials from unencrypted exposure.\n\ncacheAddress.js:\n\u003cimg width=\"3404\" height=\"1656\" alt=\"ssrf_cred_theft\" src=\"https://github.com/user-attachments/assets/0a87cef5-3c4d-450a-8bb7-35123d5f621b\" /\u003e\n\nelmslnToSite.js:\n\u003cimg width=\"3409\" height=\"1641\" alt=\"theft2\" src=\"https://github.com/user-attachments/assets/bede82cc-a613-4fc7-bbf6-76166af784f5\" /\u003e\n\nJOSHelpers.js:\n\u003cimg width=\"3407\" height=\"1597\" alt=\"theft3\" src=\"https://github.com/user-attachments/assets/4f3f8bee-443e-4b22-9d41-eb9726619d36\" /\u003e\n\n### Impact\nThis vulnerability allows internal data, including secrets, to be exfiltrated to an attacker-controlled domain. Credentials were confirmed with the maintainer to grant access to unreleased LMS content on subsequent systems; out of scope for PoC.","status":"published","published":"2026-05-19T14:44:46Z","modified":"2026-06-09T11:56:37Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"high"}],"cwes":["CWE-183","CWE-918"],"updated_at":"2026-11-02T14:40:23.739691Z"}],"nvd":[{"id":"CVE-2026-46391","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.","status":"published","published":"2026-06-05T19:16:33.007Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-183","CWE-918"],"updated_at":"2026-11-02T14:12:22.73178Z"}],"osv":[{"id":"GHSA-4fg7-f244-3j49","title":"HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis","description":"### Summary\nMultiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication.\n\n### Details\n[api/services/website/cacheAddress.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/services/website/cacheAddress.js#L21), [api/apps/haxcms/lib/JOSHelpers.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/lib/JOSHelpers.js#L26), and [api/apps/haxcms/convert/elmslnToSite.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/convert/elmslnToSite.js#L37) use similar logic to check for hard-coded site names. However, the logic only looks for the substring to be included in the user-controlled string, allowing an attacker to craft an API call and extract the credentials intended for the hard-coded domains.\n\n### PoC\nMaking API calls to an affected endpoint will result in credential theft. The attacker-controlled domains in these proofs of concept are `cloudflared` tunnels, protecting the production credentials from unencrypted exposure.\n\ncacheAddress.js:\n\u003cimg width=\"3404\" height=\"1656\" alt=\"ssrf_cred_theft\" src=\"https://github.com/user-attachments/assets/0a87cef5-3c4d-450a-8bb7-35123d5f621b\" /\u003e\n\nelmslnToSite.js:\n\u003cimg width=\"3409\" height=\"1641\" alt=\"theft2\" src=\"https://github.com/user-attachments/assets/bede82cc-a613-4fc7-bbf6-76166af784f5\" /\u003e\n\nJOSHelpers.js:\n\u003cimg width=\"3407\" height=\"1597\" alt=\"theft3\" src=\"https://github.com/user-attachments/assets/4f3f8bee-443e-4b22-9d41-eb9726619d36\" /\u003e\n\n### Impact\nThis vulnerability allows internal data, including secrets, to be exfiltrated to an attacker-controlled domain. Credentials were confirmed with the maintainer to grant access to unreleased LMS content on subsequent systems; out of scope for PoC.","status":"published","published":"2026-05-19T14:44:46Z","modified":"2026-09-10T03:50:45.404977915Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"high"}],"cwes":["CWE-183","CWE-918"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}