The vulnerability in haxcms‑php stems from the use of PHP's uniqid() function to generate salts for stored passwords. uniqid() produces pseudo‑random, time‑based identifiers that are predictable and not cryptographically strong. An attacker who can obtain or guess these salts could pre‑compute hash tables or mount brute‑force attacks against user passwords, possibly gaining unauthorized access. This weakness is identified as CWE‑338, a weakness in cryptographic key generation.

Affected software is haxtheweb’s haxcms‑php. Any instance running a version earlier than 26.0.1 is vulnerable. The updated release 26.0.1 replaces the salt generation with a secure random method, removing the risk.

The CVSS score of 7.5 indicates high severity, but the EPSS score is not available, making it unclear how frequently this is exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no documented widespread exploitation. The likely attack vector involves remote authentication attempts after the salt is known or can be approximated. If an attacker already has the salts or can extract them via other vulnerabilities, they can more easily crack stored passwords. The criticality is mitigated by the update in version 26.0.1, which addresses the flaw.