Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is set without the Secure flag. This allows it to be transmitted over unencrypted HTTP, making it vulnerable to theft via packet sniffing on the network. Version 26.0.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-46398 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is set wi… https://www.cve.org/CVERecord?id=CVE-2026-46398
Post summary
The text reports a newly disclosed vulnerability (CVE-2026-46398) in HAX CMS that involves an insecurely set authentication cookie across certain versions.
CVE-2026-46398 Insecure Cookie Transmission in HAX CMS Versions 25.0.0 Through 26.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-46398
Post summary
The post references CVE-2026-46398 with a title indicating insecure cookie transmission in HAX CMS and provides a link to a vulnerability details page, but offers no additional information on exploitation, patches, or technical specifics.