CVE-2026-46398 Details

A vulnerability exists in HAX CMS versions 25.0.0 prior to 26.0.0, where the haxcms_refresh_token cookie is transmitted without the Secure flag. This omission allows the cookie to be sent over unencrypted HTTP, exposing it to potential theft through packet sniffing. The vulnerability could lead to session hijacking via a man-in-the-middle attack.

Users can upgrade to HAX CMS version 26.0.0 or later, where this vulnerability has been addressed. For those using version 25.0.0, the Secure flag can be manually added to the haxcms_refresh_token cookie by modifying the setcookie function to include the Secure attribute. It is also recommended to enforce HTTPS for all connections and consider adding the SameSite attribute to the cookie.