Vulnerability · Published Jun 5, 2026 · Assigned by GitHub_M
CVE-2026-46493haxtheweb/haxcms-php uses insecure method for generating salt
High 7.5
In plain English
A high-severity security flaw in haxcms-php from haxtheweb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 78.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generating salts, which is unsuitable. Version 26.0.1 fixes the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| haxtheweb | haxcms-php | < 26.0.1 |
Weakness: CWE-338 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/haxtheweb/issues/security/advisories/GHSA-xg43-xm47-74cp x_refsource_CONFIRM
- https://github.com/haxtheweb/haxcms-php/commit/4b83cbdf8782c75bdcdd4f57ba72fba1c6dac147 x_refsource_MISC
- https://github.com/haxtheweb/haxcms-php/blob/8b8845b16e521a326929471e16903f60c6638e8f/install.php#L188-L191 x_refsource_MISC