CVE-2026-87929: Critical severity Maxsite MaxSite CMS vulnerability
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in islogin() and msocheckallow() functions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the hardcoded session encryption key in application/config/config.php for MaxSite CMS through 109.6 to a new secret value so attackers cannot forge administrator ci_session cookies via HMAC-SHA1.
MaxSite CMS (application/config/config.php) session encryption key = not specified in material
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it if they can reach the affected MaxSite CMS instance. No existing account, user interaction, or special access is required.
Are default installations affected?
Yes. The vulnerable session encryption key is hardcoded in application/config/config.php and is not changed during installation, so installations using the shipped configuration are exposed.
What does an attacker need to do to bypass authentication?
The attacker needs to create a malicious ci_session cookie representing an administrator session and calculate its HMAC-SHA1 using the publicly known hardcoded key. The forged cookie can bypass the is_login() and mso_check_allow() authentication checks.
How can I determine whether an instance is affected?
Check whether the deployment is MaxSite CMS version 109.6 or earlier and inspect application/config/config.php for the shipped hardcoded session encryption key. If that key remains unchanged, administrator session cookies may be forgeable.