The HAX CMS NodeJS application is vulnerable to unauthorized access due to hardcoded default credentials and predictable JWT secrets, which could allow an unauthenticated attacker to take control of affected instances.

This vulnerability involves the use of hardcoded default credentials and static JWT private keys, which are publicly discoverable in the vendor's GitHub repository. An unauthenticated attacker can leverage these hardcoded values to bypass authentication and gain full administrative access to unconfigured self-hosted installations.

The exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of any data hosted within the HAX CMS environment. Because the default credentials and keys are publicly known, an attacker can easily gain administrative control, leading to unauthorized site modification, data exfiltration, or further malicious activity within the internal network. With a CVSS score of 7.3, this flaw represents a high risk that requires immediate remediation.

Immediate Action: Update the HAX CMS NodeJS application to version 11.0.10 or later immediately. Users should also ensure that no previous instances of the application remain exposed with default configurations.

Proactive Monitoring: Monitor server logs for unauthorized login attempts or suspicious administrative activity performed by users who were not explicitly authorized to manage the CMS.

Compensating Controls: If an immediate update is not feasible, restrict network access to the HAX CMS instance using a firewall or VPN to ensure only trusted users can reach the application interface.

Public Exploit Available: Unknown

Given that the default credentials and secrets are publicly available in the source code, the window for exploitation is high. Organizations running HAX CMS NodeJS must prioritize upgrading to version 11.0.10 to remove these hardcoded values. Failure to update leaves the application wide open to unauthorized administrative takeover.