Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@haxtheweb/open-apis

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7npmAmendedPublished

    HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

    CVE-2026-46391 · GHSA-4fg7-f244-3j49

    Affected
    • npm @haxtheweb/open-apis < 26.0.0
    Fixed in
    26.0.0· Vendor fix available
    Issue
    Multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Details api/services/website/cacheAddress.js, api/apps/haxcms/lib/JOSHelpers.js, and api/apps/haxcms/convert/elmslnToSite.js use similar logic to check for hard-coded site names. However, the logic only looks for the substring to be included in the user-controlled string, allowing an attacker to craft an API call and extract the credentials intended for the hard-coded domains. PoC Making API calls to an affected endpoint will result in credential theft. The attacker-controlled domains in these proofs of concept are cloudflared tunnels, protecting the production credentials from unencrypted exposure. cacheAddress.js: <img width="3404" height="1656" alt="ssrfcredtheft" src="https://github.com/user-attachments/assets/0a87cef5-3c4d-450a-8bb7-35123d5f621b" /…

    Recommended action: Upgrade to 26.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →