Skip to content
OpenAdvisories
High · 7.5 CVE-2026-46493 EUVD-2026-34896

haxtheweb/haxcms-php uses insecure method for generating salt

Published Jun 5, 2026 · Updated Jun 5, 2026 · Assigned by GitHub_M

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generating salts, which is unsuitable. Version 26.0.1 fixes the issue.

Affected products

VendorProductAffectedFixed
haxtheweb haxcms-php < 26.0.1 —

References