{"id":"EUVD-2026-34882","enisaUuid":"1f4a4a42-9594-3ed6-8606-1879fb852c08","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.","datePublished":"Jun 5, 2026, 6:18:42 PM","dateUpdated":"Jun 8, 2026, 4:18:38 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","references":"https://github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49\n","aliases":"CVE-2026-46391\nGHSA-4fg7-f244-3j49\n","assigner":"GitHub_M","epss":0.46,"enisaIdProduct":[{"id":"b738563d-824e-3a97-bace-a3bd74dd9c0b","product":{"name":"@haxtheweb/open-apis","vendor":{"name":"haxtheweb"}},"product_version":"9.0.1, \u003c 26.0.0"}],"enisaIdVendor":[{"id":"0bcee71f-f909-3e78-acef-85879310e569","vendor":{"name":"haxtheweb"}}],"enisaIdVulnerability":[{"id":"22d19ba6-97bd-39b1-af69-430ae63fc649","vulnerability":{"id":"GHSA-4fg7-f244-3j49","description":"HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis","datePublished":"May 19, 2026, 2:44:46 PM","dateUpdated":"Jun 9, 2026, 11:56:37 AM","baseScore":0.0,"references":"https://github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46391\nhttps://github.com/haxtheweb/issues\n","enisa_id":"EUVD-2026-34882\n","aliases":"CVE-2026-46391\nGHSA-4fg7-f244-3j49\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"aaeb6456-0f6c-32a4-a7ab-a0aa69ed3533","vulnerability":{"id":"CVE-2026-46391","description":"HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.","datePublished":"Jun 5, 2026, 6:18:42 PM","dateUpdated":"Jun 8, 2026, 4:18:38 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","references":"https://github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49\n","enisa_id":"EUVD-2026-34882\n","assigner":"GitHub_M","epss":0.46,"dataProcessed":"Oct 30, 2026, 7:18:29 AM","vulnerabilityProduct":[{"id":"75833e49-153e-3f7f-8b1d-427d65258262","product":{"name":"@haxtheweb/open-apis","vendor":{"name":"haxtheweb"}},"product_version":"9.0.1, \u003c 26.0.0"}],"vulnerabilityVendor":[{"id":"31d34192-1e7d-3486-87eb-0877491ff45f","vendor":{"name":"haxtheweb"}}]}}],"enisaIdAdvisory":[]}