CVE-2026-46398

Vulnerability

Starting in version 25.0.0 and prior to version 26.0.0, HAX CMS sets the haxcms_refresh_token cookie without the Secure flag. This vulnerability exists in the system/backend/php/lib/Operations.php file [1].

Exploitation

An attacker on the same network as a victim can intercept network traffic and steal the haxcms_refresh_token cookie if the victim accesses the HAX CMS application over an unencrypted HTTP connection. This can be achieved through packet sniffing [1].

Impact

Successful exploitation allows an attacker to hijack the victim's session by using the stolen haxcms_refresh_token cookie, potentially gaining unauthorized access to the HAX CMS application with the victim's privileges [1].

Mitigation

Version 26.0.0 addresses this issue by setting the Secure flag to true for the haxcms_refresh_token cookie [1]. It is recommended to enforce HTTPS for all connections and consider adding the SameSite attribute to cookies [1].