cve-2026-46391

CVE-2026-46391 - Credential Exposure via SSRF in @haxtheweb/open-apis Proof of concept for CVE-2026-46391. Triggers the SSRF vulnerability in the cacheAddress endpoint of @haxtheweb/open-apis and captures the service account credentials sent in the callback. Build go build -o cve-2026-46391 . Tes...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46357 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46357 Source advisory: MEND:CVE-2026-46357...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46493 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46493 Source advisory: MEND:CVE-2026-46493...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46401 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46401 Source advisory: MEND:CVE-2026-46401...

@haxtheweb/create (>=25.0.2, <=26.0.0), @haxtheweb/open-apis (>=25.0.0, <=26.0.0) potentially affected by CVE-2026-46398 via @haxtheweb/haxcms-nodejs (25.0.0)

@haxtheweb/haxcms-nodejs NPM version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/haxcms-nodejs and may be impacted: - @haxtheweb/create =25.0.2, =25.0.0, =26.0.0 Source cves: CVE-2026-46398 Source advisory: MEND:CVE-2026-46398...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46397 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46397 Source advisory: MEND:CVE-2026-46397...

@haxtheweb/app-editor-hax (>=9.0.0-alpha.0, <=9.0.1), @haxtheweb/app-hax (>=9.0.19, <=25.0.0) +33 more potentially affected by CVE-2026-46496 via @haxtheweb/video-player (>=9.0.27, <=25.0.0)

@haxtheweb/video-player NPM version =9.0.27, =9.0.0-alpha.0, =9.0.19, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.19, =9.0.25, =9.0.20, =9.0.22, =9.0.22, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.9, =0.0.0, =9.0.0-alpha.0, =25.0.0 and more Source cves: CVE-2026-46496 Source advisory:...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46496 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46496 Source advisory: MEND:CVE-2026-46496...

@haxtheweb/app-editor-hax (>=9.0.0-alpha.0, <=9.0.1), @haxtheweb/app-hax (>=9.0.19, <=25.0.0) +33 more potentially affected by CVE-2026-46396 via @haxtheweb/iframe-loader (>=9.0.22, <=25.0.0)

@haxtheweb/iframe-loader NPM version =9.0.22, =9.0.0-alpha.0, =9.0.19, =9.0.0-alpha.0, =9.0.19, =9.0.25, =9.0.20, =9.0.22, =9.0.22, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.9, =0.0.0, =9.0.19, =9.0.0-alpha.0, =25.0.0 and more Source cves: CVE-2026-46396 Source advisory:...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46396 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46396 Source advisory: MEND:CVE-2026-46396...

@haxtheweb/app-editor-hax (>=9.0.0-alpha.0, <=9.0.1), @haxtheweb/app-hax (>=9.0.19, <=25.0.0) +33 more potentially affected by CVE-2026-46396 via @haxtheweb/video-player (>=9.0.27, <=25.0.0)

@haxtheweb/video-player NPM version =9.0.27, =9.0.0-alpha.0, =9.0.19, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.19, =9.0.25, =9.0.20, =9.0.22, =9.0.22, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.9, =0.0.0, =9.0.0-alpha.0, =25.0.0 and more Source cves: CVE-2026-46396 Source advisory:...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46511 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46511 Source advisory: MEND:CVE-2026-46511...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46395 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46395 Source advisory: MEND:CVE-2026-46395...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46393 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46393 Source advisory: MEND:CVE-2026-46393...

CVE-2026-46391

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the...

@haxtheweb/create (>=9.0.11, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46391 via @haxtheweb/open-apis (>=9.0.12, <=25.0.0)

@haxtheweb/open-apis NPM version =9.0.12, =9.0.11, =11.0.2, =26.0.0 Source cves: CVE-2026-46391 Source advisory: MEND:CVE-2026-46391...

@haxtheweb/create (>=9.0.1, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46390 via @haxtheweb/haxcms-nodejs (>=9.0.21, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =9.0.21, =9.0.1, =11.0.2, =26.0.0 Source cves: CVE-2026-46390 Source advisory: MEND:CVE-2026-46390...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46399 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46399 Source advisory: MEND:CVE-2026-46399...

CVE-2026-46391: Permissive List of Allowed Inputs

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-48527 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-48527 Source advisory: MEND:CVE-2026-48527...