CVE-2026-86241: liufee FeehiCMS Cookie Validation main-local.php hard-coded key
A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are potentially affected?
liufee FeehiCMS versions up to and including 2.1.1 are identified as affected. The issue is in the production backend configuration file environments/prod/backend/config/main-local.php, specifically its cookieValidationKey setting.
What does an attacker need to exploit this issue?
The attack can be carried out remotely and requires no privileges. User interaction is required according to the provided severity vector.
Is public exploit code available?
Yes. The exploit has been made public and could be used in attacks.
Is a vendor fix available?
The provided information does not identify a fix. It states that the project was notified through an issue report but had not responded at the time of the report.