The vulnerability is an improper session expiration flaw that allows authentication tokens to remain valid after the user logs out. An attacker who obtains a valid token can therefore continue to access the CMS, including administrative functions and metadata, beyond the intended session lifetime. The flaw directly maps to CWE-613, which concerns failures to properly terminate sessions.

All HAX CMS deployments built before version 26.0.0 from haxtheweb are affected. The issue was addressed in the 26.0.0 release, so any instance running an earlier patch level may be exposed.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector implicitly requires an attacker to first acquire a valid session token, typically through credential compromise or another pre‑existing vulnerability. Once a token is obtained, the attacker can maintain persistent authenticated access without needing to re‑authenticate, thereby elevating the risk of unauthorized data exposure or configuration changes.