CVE-2026-46398
HAX CMS Missing Secure Flag on Cookie
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is set without the Secure flag. This allows it to be transmitted over unencrypted HTTP, making it vulnerable to theft via packet sniffing on the network. Version 26.0.0 fixes the issue.
| CWE | CWE-614 |
| Vendor | haxtheweb |
| Product | haxcms-php |
| Published | Jun 5, 2026 |
| Last Updated | Jun 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for haxtheweb haxcms-php
Be the first to know when new unknown vulnerabilities affecting haxtheweb haxcms-php are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
haxtheweb / haxcms-php
>= 25.0.0, < 26.0.0