GitHub Advisoryadvisory · npm

GHSA-5fpv-5qvh-7cf3 NodeJS version of the HAX CMS application is distributed with Default Secrets

HIGH Published 2025-07-21 Modified 2025-07-23 Official page ↗
Aliases
CVE-2025-54137
Ecosystem
npm
Packages
@haxtheweb/haxcms-nodejs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1392
Reviewed
2025-07-21

Affected packages

• npm @haxtheweb/haxcms-nodejs: < 11.0.10 → fixed in 11.0.10

Description

Summary The NodeJS version of the HAX CMS application is distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. Affected Resources • HAXCMS.js HAXCMSClass Impact An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks.

Related

Alias · CVE (1)

  • CVE-2025-54137 HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. vulnerability

Weakness · CWE (1)

  • CWE-1392 Use of Default Credentials weakness

References