CVE-2025-54137 json
NodeJS version of the HAX CMS application is distributed with Default Secrets
published 2025-07-21 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-22383 , GHSA-5fpv-5qvh-7cf3
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks. This is fixed in version 11.0.10.
Patch / fix
- npm @haxtheweb/haxcms-nodejs 11.0.10
- haxtheweb hax 11.0.10
- haxtheweb haxcms-nodejs 11.0.10
- psu haxcms-nodejs 11.0.10
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 15 mo ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @haxtheweb/haxcms-nodejs | <11.0.10 |
11.0.10 |
Affected products
- haxtheweb issues
Classification
- Weakness
-
- CWE-1392 Use of Default Credentials
References
-
github.com
/haxtheweb/haxcms-nodejs/commit/6dc2441c876350ca6fe9fbaecb058d92ef442869
web, patch
-
github.com
/haxtheweb/issues/security/advisories/GHSA-5fpv-5qvh-7cf3
web, third-party-advisory
-
github.com
/haxtheweb/haxcms-nodejs/blob/main/src/lib/HAXCMS.js#L1614
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2025-54137
advisory
-
github.com
/haxtheweb/issues
package
Sources
- CVE List CVE-2025-54137
- GitHub Advisory GHSA-5fpv-5qvh-7cf3
- NVD CVE-2025-54137
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.