CVE-2026-46493: haxtheweb/haxcms-php uses insecure method for generating salt

Synopsis

This is a weak cryptographic salt generation vulnerability in haxtheweb/haxcms-php. The affected versions use PHP's `uniqid()` function to generate salts for password hashing or token generation, a function based on the current timestamp that produces predictable output rather than cryptographically random values. An unauthenticated remote attacker who can observe or guess timing information can reconstruct salts, potentially breaking the confidentiality of protected data such as credentials or session material. HarborGuard tracks the upstream advisory for patch availability, as no fix version has been published to package registries at this time.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The affected service must be reachable over the network; an attacker interacts with it remotely without requiring any foothold on the host.

• AuthenticationNot required

  No account or credentials are needed to attempt exploitation; the vulnerable code path is reachable by any unauthenticated request.

• Victim interactionNot required

  No user action is required; the attacker can probe or exploit the weakness entirely without involving another party.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker can reconstruct predictable salts derived from `uniqid()` timestamps, breaking the confidentiality of hashed secrets such as passwords or API tokens stored in the application.
• Recovered credentials or tokens allow the attacker to read protected site content, user data, and any information gated behind those secrets.
• No integrity or availability impact is indicated by the CVSS vector; the attacker gains read access but cannot modify or destroy data through this vulnerability alone.