CVE-2026-46391: HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

Synopsis

This is a Server-Side Request Forgery (SSRF) credential theft vulnerability in the @haxtheweb/open-apis package, which is part of the HAX CMS microsite management system. The flaw is reachable over the network with no authentication required, because multiple functions use substring-only hostname matching to decide when to attach HTTP Basic Authorization headers. A successful attacker can trick the affected server into sending those credentials to an attacker-controlled endpoint, capturing authentication tokens without any victim interaction. No fix version has been published upstream; HarborGuard is actively tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends crafted requests to the exposed endpoint from a remote location.

• AuthenticationNot required

  No credentials or account are needed to trigger the vulnerable hostname-matching logic and cause the server to forward Basic Authorization headers.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link or take any action for the credential forwarding to occur.

• Attack complexityDetail

  Exploit reliability is high and no special conditions, race conditions, or environmental factors are required to carry out the attack.

Blast Radius

• Attacker captures HTTP Basic Authorization credentials (usernames and passwords or tokens) that the affected service is configured to forward to trusted hosts.
• Stolen credentials can be replayed against other services or APIs that accept the same Basic Authorization, expanding access beyond the initial target.
• Confidentiality of data accessible via the captured credentials is fully compromised; the CVSS Vulnerable Component confidentiality impact is rated High.