CVE-2026-35185

HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses

View on CVE.org
Published Apr 6, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information. This vulnerability is fixed in 25.0.0.

Analysis

AI-generated

Technical impact

The vulnerability lies in the /server-status endpoint of HAX CMS, which is publicly accessible in versions before 25.0.0. An unauthenticated request to this endpoint returns authentication tokens, user activity, client IP addresses, and server configuration data. This exposure allows an attacker to harvest valid session tokens and observe user interactions in real time, potentially facilitating credential compromise and unauthorized system access.

Affected Systems

The affected product is HAX CMS (HAXiam) from haxtheweb. All installations running a version earlier than 25.0.0 are vulnerable. The issue was addressed in the 25.0.0 release.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. The attack vector is simple: any user with network access can send an unauthenticated GET request to /server-status. No authentication or privileged access is required. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it may not yet be widely exploited but could be leveraged by an attacker due to its ease of access.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade HAX CMS to version 25.0.0 or newer according to the vendor’s release notes.
  • If an upgrade cannot be performed immediately, block public access to the /server-status endpoint, for example by adjusting web server configuration or adding authentication.
  • Verify that the endpoint no longer returns authentication tokens and other sensitive data after mitigation measures are applied.

Generated by OpenCVE AI on April 7, 2026 at 01:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Psu
Psu haxiam
CPEs cpe:2.3:a:psu:haxiam:11.0.5:*:*:*:*:*:*:*
Vendors & Products Psu
Psu haxiam
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Haxtheweb
Haxtheweb hax
Vendors & Products Haxtheweb
Haxtheweb hax
Type Values Removed Values Added
Description HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information. This vulnerability is fixed in 25.0.0.
Title HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses
Weaknesses CWE-284
CWE-522
CWE-532
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-522

    Insufficiently Protected Credentials

  • CWE-532

    Insertion of Sensitive Information into Log File

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Apr 7, 2026, 3:10 PM
Reserved
Apr 1, 2026, 5:26 PM

View source JSON

Updated
Apr 7, 2026, 3:05 PM

JSON

Status
Analyzed
Published
Apr 6, 2026, 8:16 PM
Modified
Jul 24, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 7, 2026, 9:37 AM

JSON