{"cve":"CVE-2025-54127","nvd":{"published":"2025-07-21T21:15:26.403","modified":"2026-06-17T09:39:29.927","status":"Analyzed","description":"HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks. If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication. This is fixed in version 11.0.7.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-1188"],"references":["https://github.com/haxtheweb/issues/security/advisories/GHSA-f38f-jvqj-mfg6"],"products":["psu:haxcms-nodejs"],"source":"nvd","synced_at":"2026-10-19T22:05:46.678065081+00:00"},"epss":{"cve":"CVE-2025-54127","score":0.00456,"percentile":0.3962,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-f38f-jvqj-mfg6","url":"https://osv.dev/vulnerability/GHSA-f38f-jvqj-mfg6","summary":"NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access","modified":"2025-07-21T22:21:21Z","packages":[{"ecosystem":"npm","name":"@haxtheweb/haxcms-nodejs","purl":"pkg:npm/%40haxtheweb/haxcms-nodejs","ranges":["<11.0.7"],"fixed":["11.0.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}