CVE-2025-54137

CVE-2025-54137 affects HAX CMS NodeJS versions 11.0.9 and below, stemming from hardcoded default credentials and JWT private keys. An unauthenticated attacker can easily obtain these secrets from public GitHub repositories, enabling unauthorized access, site modification, and further attacks on unconfigured self-hosted instances. This vulnerability carries a high severity CVSS score of 7.3 due to its network-based attack vector, low complexity, and potential for significant impact (confidentiality, integrity, and availability). While there is no evidence of active exploitation, public exploit code, or significant community discussion, the ease of exploitation makes it a notable risk for unpatched systems.