Cyber Resilience

CVE-2026-46398

HighUpdated

Published: 05 June 2026

Published
05 June 2026
Modified
17 June 2026
KEV Added
—
Patch
—
CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0018 8.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-46398 is a high-severity Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CWE-614) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 8.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A02:2025 Security Misconfiguration

EU & UK References

Vulnerability details

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is set without the Secure flag. This allows it to be transmitted over unencrypted HTTP, making it…

more

vulnerable to theft via packet sniffing on the network. Version 26.0.0 fixes the issue.

CWE(s)
CWE-614

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1040 Network Sniffing Credential Access
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
attack.mitre.org →
Why these techniques?

Cookie without Secure flag directly enables theft of refresh token via network/packet sniffing (T1040).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-23 Session Authenticity
addresses: CWE-614

Forces the Secure flag on session cookies, preventing their transmission over unauthenticated HTTP channels.

SC-8 Transmission Confidentiality and Integrity
addresses: CWE-614

Enforcing confidentiality on transmitted sensitive cookies requires the Secure attribute, preventing exposure on insecure channels.

References