CVE-2026-87929 — MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated atta…
Published: 2026-09-09 · CVSS: 9.3 · CVSS 4.0
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7