An implementation error in the hmacBase64() function of the HAX CMS Node.js backend allows an unauthenticated attacker to retrieve the system's private signing key and create forged admin‑level JSON Web Tokens. The function mistakenly uses a constant key of "0" for the HMAC and appends the real private key and salt to the output, resulting in a base64‑encoded token that exposes the key when decoded. An attacker can obtain the key by sending a single GET request to the unauthenticated /system/api/connectionSettings endpoint, which returns multiple such tokens. With this key, the attacker can issue arbitrary admin JWTs and gain full administrative control over the CMS. This flaw can be exploited remotely over HTTP and results in a high‑severity privilege escalation vulnerability.

The vulnerable component is the HAX CMS application provided by haxtheweb, specifically the Node.js backend. All releases prior to version 26.0.0 contain the broken hmacBase64() function. The PHP backend implementation is correct and is not affected. The issue presents itself via the /system/api/connectionSettings endpoint, which is publicly accessible in affected deployments.

The CVSS score of 9.3 indicates a critical severity. The lack of an EPSS score suggests the exploitation probability is not quantified, but the flaw is straightforward to leverage, requiring only an unauthenticated HTTP request. The vulnerability is not listed in the CISA KEV catalog, but the impact remains severe. An attacker can immediately extract the private key and craft admin tokens without any additional prerequisites, making the risk high for any exposed HAX CMS instance running a pre‑26.0.0 Node.js backend.