Medium severity · published Jun 5, 2026
CVE-2026-46401
HAX CMS PHP has Insufficient Session Expiration
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper session termination vulnerability where authentication tokens remain valid after user logout. This allows attackers who obtain valid tokens to maintain persistent access to authenticated CMS functionality, bypassing the intended session termination mechanism and enabling unauthorized access to CMS metadata and administrative functions. Version 26.0.0 fixes the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
issues · haxtheweb
< 26.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46401
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46401
github.com
https://github.com/haxtheweb/issues/security/advisories/GHSA-g5rc-4gpf-wx3w
More from issues
9.9
CVE-2025-32028
HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution
9.8
CVE-2025-54127
HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
8.8
CVE-2025-49141
HaxCMS-PHP Command Injection Vulnerability
8.3
CVE-2025-54378
HAX CMS Backend Lacks Comprehensive Authorization Checks
7.3
CVE-2025-54137
NodeJS version of the HAX CMS application is distributed with Default Secrets