The haxcms_refresh_token cookie is set without the Secure flag in HAX CMS versions 25.0.0 through 25.x.x, exposing the token to transmission over unencrypted HTTP. This vulnerability allows an attacker who can sniff network traffic to capture the refresh token, potentially hijacking a user’s session and gaining unauthorized access to the CMS. The flaw is an instance of CWE-614, which concerns improper management of user credentials stored in cookies.

HAX CMS running on a PHP backend from haxtheweb, specifically any release from version 25.0.0 up to but not including 26.0.0. Versions 26.0.0 and newer are not affected by this issue.

The CVSS score of 8.8 indicates a high severity; although no EPSS score is available, the absence of a KEV listing does not diminish the risk of exploitation. The likely attack vector is intercepting the haxcms_refresh_token cookie over an unsecured HTTP connection. An attacker who controls or monitors an unencrypted HTTP connection can easily intercept the cookie, and because the token is a refresh token, the hijacked session can potentially be used to obtain long‑term access. The vulnerability is likely exploitable by anyone able to observe traffic to the site, making the threat surface quite broad in environments where HTTPS is not enforced.