How severe is CVE-2026-46391?

CVE-2026-46391 has a CVSS 4.0 base score of 8.7, rated high severity.

Is CVE-2026-46391 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-46391?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-46391 have an EU (EUVD) identifier?

Yes. CVE-2026-46391 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34882.

When was CVE-2026-46391 published?

CVE-2026-46391 was published on 2026-06-05 and last updated on 2026-06-17.

CVE-2026-46391

CVE-2026-46391 is a high-severity vulnerability with a CVSS 4.0 base score of 8.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-183.

Key facts

Severity: High (CVSS 4.0 base score 8.7)
EPSS exploit prediction: 0% (37th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-34882
Weakness: CWE-183
Published: 2026-06-05
Last modified: 2026-06-17

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.

Frequently asked questions

What is CVE-2026-46391?: HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.
How severe is CVE-2026-46391?: CVE-2026-46391 has a CVSS 4.0 base score of 8.7, rated high severity.
Is CVE-2026-46391 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-46391?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-46391 have an EU (EUVD) identifier?: Yes. CVE-2026-46391 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34882.
When was CVE-2026-46391 published?: CVE-2026-46391 was published on 2026-06-05 and last updated on 2026-06-17.

References

https://github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49

Other CWE-183 vulnerabilities

CVE-2026-3490 — Critical (CVSS 10.0): picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by…
CVE-2026-54316 — Critical (CVSS 9.1): Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved…
CVE-2026-29514 — High (CVSS 8.8): NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the…
CVE-2025-53762 — High (CVSS 8.7): Permissive list of allowed inputs in Microsoft Purview allows an authorized attacker to elevate privileges over a…
CVE-2026-41387 — High (CVSS 7.8): OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in…
CVE-2025-59457 — High (CVSS 7.7): In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows

Browse all CWE-183 vulnerabilities →