The vulnerability CVE-2026-46398 affects haxcms-php versions starting from 25.0.0 up to but not including 26.0.0. The haxcms_refresh_token cookie is set without the Secure flag, allowing it to be sent over unencrypted HTTP connections. This behavior violates best practices for sensitive cookies in HTTPS sessions, as described by CWE-614. The absence of the Secure attribute increases the risk of cookie theft through network interception. Version 26.0.0 of haxcms-php addresses this issue by properly setting the Secure flag on the cookie.

An attacker capable of intercepting network traffic between the client and server could capture the haxcms_refresh_token cookie if transmitted over HTTP, potentially leading to session hijacking or unauthorized access. The vulnerability does not require user interaction or privileges and can be exploited remotely over the network. The CVSS 4.0 base score is 8.8 (high), reflecting the ease of exploitation and the potential impact on confidentiality.

Upgrade haxcms-php to version 26.0.0 or later, where the haxcms_refresh_token cookie is set with the Secure attribute. This official fix ensures the cookie is only transmitted over encrypted HTTPS connections, mitigating the risk of interception. Until the upgrade is applied, avoid using unencrypted HTTP connections to access the application to reduce exposure.