GHSA-5fpv-5qvh-7cf3 CVE-2025-54137
NodeJS version of the HAX CMS application is distributed with Default Secrets
- Severity
- 7.3 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.39%
- Chance of exploitation in the next 30 days. Higher than 33.57% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1392 Use of Default Credentials
- Fix
11.0.10- Upgrade @haxtheweb/haxcms-nodejs to this version or later
Description
Summary
The NodeJS version of the HAX CMS application is distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI.
Affected Resources
- HAXCMS.js HAXCMSClass
Impact
An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| @haxtheweb/haxcms-nodejs | < 11.0.10 |
11.0.10 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
@haxtheweb/haxcms-nodejs npm → 11.0.10
- npm
npm install @haxtheweb/haxcms-nodejs@11.0.10- yarn
yarn add @haxtheweb/haxcms-nodejs@11.0.10- pnpm
pnpm add @haxtheweb/haxcms-nodejs@11.0.10
Severity breakdown
CVSS 3.1 7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Weakness
CWE-1392: Use of Default Credentials
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
How to prevent it
- Requirements: Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
- Architecture and Design: Force the administrator to change the credential upon installation.
- Installation, Operation: The product administrator could change the defaults upon installation or during operation.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-g2g8-95qg-v35h HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint | High | Also affects @haxtheweb/haxcms-nodejs |
| GHSA-9r33-xhw8-4qqp HAX CMS: Denial of Service using Malicious Import Request | Medium | Also affects @haxtheweb/haxcms-nodejs |
| GHSA-x3x5-7h4h-gwxg HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack | High | Also affects @haxtheweb/haxcms-nodejs |
| GHSA-jh3h-rpxg-fr36 Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover | High | Also affects @haxtheweb/haxcms-nodejs |
| GHSA-6c8g-9hfh-pq5h HAXcms: Private Key Disclosure via Broken HMAC Implementation | Critical | Also affects @haxtheweb/haxcms-nodejs |
| GHSA-2m6p-hm3w-6jm3 HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft | Medium | Also affects @haxtheweb/haxcms-nodejs |
| GHSA-q862-gcgq-5m6g HAXcms createSite SSRF Enables Arbitrary File Read | High | Also affects @haxtheweb/haxcms-nodejs |
| GHSA-3fm2-xfq7-7778 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover | Medium | Also affects @haxtheweb/haxcms-nodejs |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor