CVE-2025-54127
published 2025-07-21CVE-2025-54127: HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.40%
32.2th percentile
HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks. If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication. This is fixed in version 11.0.7.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| haxtheweb | haxcms-nodejs | >= 0 < 11.0.7 | 11.0.7 |
| haxtheweb | issues | < 11.0.7 | 11.0.7 |
| psu | haxcms-nodejs | < 11.0.7 | 11.0.7 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access
ghsa·2025-07-21
CVE-2025-54127 [CRITICAL] CWE-1188 NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access
### Summary
The NodeJS version of HAX CMS uses an insecure default configuration designed for local
development. The default configuration does not perform authorization or authentication checks.
### Details
If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication.
#### Affected Resources
- [package.json:13](https://github.com/haxtheweb/haxcms-nodejs/blob/a4d2f18341ff63ad2d97c35f9fc21af8b965248b/package.json#L13)
### PoC
To reproduce this vulnerability, [install](https://github.com/haxtheweb/haxcms-nodejs) HAX CMS NodeJS. The application will load without JWT che
OSV
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access
osv·2025-07-21
CVE-2025-54127 [CRITICAL] NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access
### Summary
The NodeJS version of HAX CMS uses an insecure default configuration designed for local
development. The default configuration does not perform authorization or authentication checks.
### Details
If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication.
#### Affected Resources
- [package.json:13](https://github.com/haxtheweb/haxcms-nodejs/blob/a4d2f18341ff63ad2d97c35f9fc21af8b965248b/package.json#L13)
### PoC
To reproduce this vulnerability, [install](https://github.com/haxtheweb/haxcms-nodejs) HAX CMS NodeJS. The application will load without JWT che
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-21
Published