NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access
Summary
The NodeJS version of HAX CMS uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks.
Details
If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication.
Affected Resources
PoC
To reproduce this vulnerability, install HAX CMS NodeJS. The application will load without JWT checks enabled.
Impact
Without security checks in place, an unauthenticated remote attacker could access, modify, and delete all site information.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @haxtheweb/haxcms-nodejs | < 11.0.7 | 11.0.7 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-1188- Platform
- npm
- Package
@haxtheweb/haxcms-nodejs- Disclosed
- 21.07.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-f38f-jvqj-mfg6 - CC BY 4.0
Vulnerability history: @haxtheweb/haxcms-nodejs
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 16
- First → latest
- 06.2025 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 10
- Medium 4
Disclosures per year
- 2025: 8
- 2026: 8
-
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.