Vulnerability · Published Jul 21, 2025 · Assigned by GitHub_M

CVE-2025-54127HAXcms's Insecure Default Configuration Leads to Unauthenticated Access

Critical 9.3

In plain English

A critical-severity security flaw in issues from haxtheweb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 60.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks. If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication. This is fixed in version 11.0.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@haxtheweb/haxcms-nodejs	11.0.7	GHSA-f38f-jvqj-mfg6

Affected products (as reported)

Vendor	Product	Versions
haxtheweb	issues	< 11.0.7

Weakness: CWE-1188 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/haxtheweb/issues/security/advisories/GHSA-f38f-jvqj-mfg6 x_refsource_CONFIRM