CVE-2025-53642 haxcms-nodejs and haxcms-php Improperly Terminate Sessions
Attackers can maintain access after logout because sessions are not terminated and cookies are not cleared, allowing potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-53642?
CVE-2025-53642 is a medium-severity vulnerability in haxtheweb issues, published on 11 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.
Weakness: CWE-613
Which versions are affected by CVE-2025-53642?
It affects 2 products.
Products include Psu Haxcms-Nodejs, Psu Haxcms-Php.
How do I fix CVE-2025-53642?
No fix has been published for CVE-2025-53642 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-53642 being exploited?
There is no known exploitation of CVE-2025-53642 in the wild and no public exploit code.
Other vulnerabilities in haxtheweb issues
- CVE-2025-54127 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
- CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability
- CVE-2025-49137 Hax CMS Stored Cross-Site Scripting vulnerability
- CVE-2025-54378 HAX CMS Backend Lacks Comprehensive Authorization Checks
- CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
Sources
Also known as GHSA-g4f5-5w5j-p5jg.