CVE-2026-46395: HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

Synopsis

A cryptographic key disclosure vulnerability in the HAX CMS Node.js backend allows any unauthenticated attacker to extract the system's private signing key with a single HTTP GET request. The `hmacBase64()` function mistakenly uses the literal string "0" as the HMAC key and then appends the real `privateKey+salt` directly to the output buffer before base64-encoding it, so the secret is trivially recoverable by decoding any token and skipping the first 32 bytes. With the private key in hand, an attacker forges arbitrary admin-level JWTs and gains full administrative access to the CMS. No fix version has been published yet; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable `/system/api/connectionSettings` endpoint is exposed over the network, so the attacker must be able to send an HTTP request to the target host.

• AuthenticationNot required

  The endpoint is completely unauthenticated; no account, session, or credential of any kind is needed to retrieve the private key.

• Victim interactionNot required

  Exploitation is fully passive from the victim's perspective and requires no user action; a single GET request from the attacker is sufficient.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the token structure is deterministic across all affected instances, so key extraction is a straightforward base64-decode-and-slice operation with no race conditions or environmental variables to manage.

Blast Radius

• Attacker recovers the instance's `privateKey+salt` directly from the decoded token, giving them the master signing secret for the entire CMS.
• With the private key, the attacker forges arbitrary admin-level JWTs and authenticates as a full administrator with no credential brute-forcing required.
• As an admin, the attacker reads, modifies, or deletes all CMS content, user records, and site configuration stored in the backend.
• Full admin access enables the attacker to install or alter server-side content, potentially pivoting to further compromise of the hosting environment.