Threats affecting pkg:github/haxtheweb/HAXiam

CVE-2026-35185 is a high-severity improper access control vulnerability in haxtheweb's HAXiam product prior to version 25.0.0. The /server-status endpoint is publicly accessible without authentication, exposing sensitive information such as authentication tokens, user activity, client IP addresses, and server configuration details. This exposure allows unauthenticated users to monitor real-time user interactions and gather internal infrastructure information. The vulnerability is fixed in version 25.0.0.