CVE-2025-54127 is a Critical severity insecure default (CVSS 9.8) in the Node.js backend of HAXcms. In versions 11.0.6 and below the default configuration disables JWT checks, so a deployment that keeps the defaults has no authentication at all. Version 11.0.7 fixes it, so upgrade and check your settings.
What's affected
The advisory says haxcms-nodejs versions 11.0.6 and below are affected, and that the problem is fixed in 11.0.7.
The default configuration was written for local development. It sets HAXCMS_DISABLE_JWT_CHECKS to true, which means that no authorization or authentication checks run. Anyone who deploys the package without changing the settings has a site with no session authentication.
This makes the flaw a configuration problem as well as a code problem. Even after you upgrade, check that your own settings are what you intend.
How to check if you're exposed
Check the version in your project and the setting in your environment:
npm ls haxcms-nodejs
env | grep HAXCMS_DISABLE_JWT_CHECKS
grep -rn "HAXCMS_DISABLE_JWT_CHECKS" .env* config* 2>/dev/null
If the version is 11.0.6 or lower and the setting is true or missing, a request to your site needs no login. Test from outside your network, from a machine that has no session, and see whether editing functions answer. Also check container environment files and deployment manifests, since defaults often hide there.
What to do now
- Upgrade haxcms-nodejs to 11.0.7 or later.
- Set HAXCMS_DISABLE_JWT_CHECKS to false in every environment that is reachable by anyone other than the developer.
- Put the site behind your normal sign in layer or a VPN while you confirm that authentication works.
- Review the site content and settings for changes you did not make, and restore from a known good backup if needed.
- Add a deployment check that fails when a development only setting appears in a production configuration.
Why it matters
The record lists CWE-1188, insecure default initialization of a resource. The product works out of the box, and the price of that convenience is a configuration with every protection switched off. People deploy what runs, and a default that is safe only on a laptop is a trap for the first person who copies it to a server.
The better pattern is a secure default with an explicit, noisy opt in for development mode. A setting that turns off authentication should refuse to start when the server listens on a public interface.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The advisory does not report attacks, but the lack of any login makes discovery by internet scanning a realistic concern.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is upgrading enough?
Upgrading to 11.0.7 is the fix named in the advisory. Also confirm that your settings enable authentication, since a custom config can still switch it off.
Why is the score Critical with no exploit needed?
Because the default configuration skips authentication entirely, so reaching the site is enough. The score reflects network access, no privileges and full impact.
Sources
Last reviewed: 18 October 2026.
