CVE-2026-46398: HAX CMS Missing Secure Flag on Cookie

Synopsis

A missing Secure flag on the session refresh cookie in HAX CMS (haxcms-php versions 25.0.0 through 25.x) allows the haxcms_refresh_token cookie to be transmitted over unencrypted HTTP connections. An attacker positioned on the same network path can capture the cookie via passive packet sniffing, requiring no authentication and no victim interaction beyond ordinary site usage. Successful exploitation lets the attacker steal the refresh token and take over authenticated sessions, leading to unauthorized access to managed content and site administration. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be positioned on a network path between the client and server to intercept unencrypted HTTP traffic carrying the cookie.

• AuthenticationNot required

  No account or credentials are needed; the attacker passively observes traffic without authenticating to the target application.

• Victim interactionNot required

  No user action beyond ordinary site usage is needed, as the cookie is transmitted automatically by the browser on every HTTP request.

• Attack complexityDetail

  Exploit reliability is high and condition-free once network access is established; no race conditions or special memory layout requirements apply.

Blast Radius

• Attacker captures the haxcms_refresh_token cookie and uses it to hijack an authenticated user session.
• With a hijacked session, the attacker reads managed site content, configuration, and any data accessible to the compromised account.
• The attacker can modify or delete microsite content and settings within the privileges of the stolen session.