CVE-2026-87929

MaxSite CMS through version 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never replaced during installation, a classic use of a hard-coded cryptographic key (CWE-321). Because the key value is publicly known, an unauthenticated remote attacker can compute a valid HMAC-SHA1 and mint a ci_session cookie carrying administrator privileges. The forged cookie passes the CMS's is_login() and mso_check_allow() authentication and authorization checks, giving the attacker full administrator control over the affected site. Any MaxSite CMS deployment at version 109.6 or older that has not manually changed the shipped key is affected. No public proof-of-concept, exploitation in the wild, or inclusion in CISA KEV is currently known.

What to do: Administrators running MaxSite CMS 109.6 or older should replace the hardcoded key in application/config/config.php with a unique, random value, which invalidates any attacker-forged session cookies, and upgrade to a patched release as soon as one is published. Review site logs for unexpected administrator logins and for ci_session cookies issued before the key was changed.