High severity · published Jun 5, 2026
CVE-2026-46398
HAX CMS Missing Secure Flag on Cookie
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is set without the Secure flag. This allows it to be transmitted over unencrypted HTTP, making it vulnerable to theft via packet sniffing on the network. Version 26.0.0 fixes the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
haxcms-php · haxtheweb
>= 25.0.0, < 26.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46398
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46398
github.com
https://github.com/haxtheweb/issues/security/advisories/GHSA-g7v2-r32q-jf5v
More from haxcms-php
9.4
CVE-2026-46399
Authenticated Remote Code Execution via File Overwrite
8.7
CVE-2026-46400
HAXCMS PHP has a File Upload Validation Bypass
8.7
CVE-2026-46511
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
8.7
CVE-2026-46392
HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation
8.7
CVE-2026-48527
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint