CVE-2026-35185 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses
Unauthenticated attackers can access the public /server-status endpoint to steal authentication tokens and monitor user activity in HAX CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35185?
CVE-2026-35185 is a high-severity vulnerability in haxtheweb HAXiam, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information. This vulnerability is fixed in 25.0.0.
Which versions are affected by CVE-2026-35185?
It affects 1 product.
Products include Psu Haxiam.
How do I fix CVE-2026-35185?
No fix has been published for CVE-2026-35185 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-35185 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35185 exists.