https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 00:02:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-325545 EUVD-2026-325545 https://cve.radiocsirt.org/vuln/euvd-2026-325545 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46391 <p>HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.</p> <p>HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46391 https://cve.radiocsirt.org/vuln/ghsa-4fg7-f244-3j49 <p><strong>Affected:</strong> npm: @haxtheweb/open-apis</p> <p>### Summary Multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication.</p> <p>### Details [api/services/website/cacheAddress.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/services/website/cacheAddress.js#L21), [api/apps/haxcms/lib/JOSHelpers.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/lib/JOSHelpers.js#L26), and [api/apps/haxcms/convert/elmslnToSite.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/convert/elmslnToSite.js#L37) use similar logic to check for hard-coded site names. However, the logic only looks for the substring to be included in the user-controlled string, allowing an attacker to craft an API call and extract the credentials intended for the hard-coded domains.</p> <p>### PoC Making API calls to an affected endpoint will result in credential theft. The attacker-controlled domains in these proofs of concept are `cloudflared` tunnels, protecting the production credentials from unencrypted exposure.</p> <p>cacheAddress.js: &lt;img width=&#34;3404&#34; height=&#34;1656&#34; alt=&#34;ssrf_cred_theft&#34; src=&#34;https://github.com/user-attachments/assets/0a87cef5-3c4d-450a-8bb7-35123d5f621b&#34; /&gt;</p> <p>elmslnToSite.js: &lt;img width=&#34;3409&#34; height=&#34;1641&#34; alt=&#34;theft2&#34; src=&#34;https://github.com/user-a…</p> <p><strong>Affected:</strong> npm: @haxtheweb/open-apis</p> <p>### Summary Multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication.</p> <p>### Details [api/services/website/cacheAddress.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/services/website/cacheAddress.js#L21), [api/apps/haxcms/lib/JOSHelpers.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/lib/JOSHelpers.js#L26), and [api/apps/haxcms/convert/elmslnToSite.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/convert/elmslnToSite.js#L37) use similar logic to check for hard-coded site names. However, the logic only looks for the substring to be included in the user-controlled string, allowing an attacker to craft an API call and extract the credentials intended for the hard-coded domains.</p> <p>### PoC Making API calls to an affected endpoint will result in credential theft. The attacker-controlled domains in these proofs of concept are `cloudflared` tunnels, protecting the production credentials from unencrypted exposure.</p> <p>cacheAddress.js: &lt;img width=&#34;3404&#34; height=&#34;1656&#34; alt=&#34;ssrf_cred_theft&#34; src=&#34;https://github.com/user-attachments/assets/0a87cef5-3c4d-450a-8bb7-35123d5f621b&#34; /&gt;</p> <p>elmslnToSite.js: &lt;img width=&#34;3409&#34; height=&#34;1641&#34; alt=&#34;theft2&#34; src=&#34;https://github.com/user-a…</p> https://cve.radiocsirt.org/vuln/ghsa-4fg7-f244-3j49