{"id":"GHSA-4fg7-f244-3j49","revision":"eb74cedbdaa7427a8cc64110e40b461a","records":[{"revision":"eb74cedbdaa7427a8cc64110e40b461a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-4fg7-f244-3j49","aliases":["CVE-2026-46391"],"title":"HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis","description":"### Summary\nMultiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication.\n\n### Details\n[api/services/website/cacheAddress.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/services/website/cacheAddress.js#L21), [api/apps/haxcms/lib/JOSHelpers.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/lib/JOSHelpers.js#L26), and [api/apps/haxcms/convert/elmslnToSite.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/convert/elmslnToSite.js#L37) use similar logic to check for hard-coded site names. However, the logic only looks for the substring to be included in the user-controlled string, allowing an attacker to craft an API call and extract the credentials intended for the hard-coded domains.\n\n### PoC\nMaking API calls to an affected endpoint will result in credential theft. The attacker-controlled domains in these proofs of concept are `cloudflared` tunnels, protecting the production credentials from unencrypted exposure.\n\ncacheAddress.js:\n<img width=\"3404\" height=\"1656\" alt=\"ssrf_cred_theft\" src=\"https://github.com/user-attachments/assets/0a87cef5-3c4d-450a-8bb7-35123d5f621b\" />\n\nelmslnToSite.js:\n<img width=\"3409\" height=\"1641\" alt=\"theft2\" src=\"https://github.com/user-attachments/assets/bede82cc-a613-4fc7-bbf6-76166af784f5\" />\n\nJOSHelpers.js:\n<img width=\"3407\" height=\"1597\" alt=\"theft3\" src=\"https://github.com/user-attachments/assets/4f3f8bee-443e-4b22-9d41-eb9726619d36\" />\n\n### Impact\nThis vulnerability allows internal data, including secrets, to be exfiltrated to an attacker-controlled domain. Credentials were confirmed with the maintainer to grant access to unreleased LMS content on subsequent systems; out of scope for PoC.","state":0,"publishedAt":"2026-05-19T14:44:46+00:00","modifiedAt":"2026-09-10T03:50:45.4049779+00:00","affected":[{"ecosystem":"npm","name":"@haxtheweb/open-apis","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"26.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49","https://nvd.nist.gov/vuln/detail/CVE-2026-46391","https://github.com/haxtheweb/issues"],"sourceUrl":"https://github.com/advisories/GHSA-4fg7-f244-3j49","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4fg7-f244-3j49","identifiers":["GHSA-4fg7-f244-3j49","CVE-2026-46391"]},"retained":false,"historicalAffected":[]}],"coverage":[]}