CVE-2026-46493 | THREATINT

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generating salts, which is unsuitable. Version 26.0.1 fixes the issue.

PUBLISHED Reserved 2026-05-14 | Published 2026-06-05 | Updated 2026-06-05 | Assigner GitHub_M

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Product status

< 26.0.1

affected

References

github.com/...issues/security/advisories/GHSA-xg43-xm47-74cp

github.com/...ommit/4b83cbdf8782c75bdcdd4f57ba72fba1c6dac147

github.com/...b16e521a326929471e16903f60c6638e8f/install.php

cve.org (CVE-2026-46493)

nvd.nist.gov (CVE-2026-46493)

Download JSON