CVE-2026-87929

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.7

Description The software contains a hardcoded session encryption key within the application/config/config.php file that remains unchanged after installation. This allows unauthenticated attackers to forge administrator session cookies by computing an HMAC-SHA1 (a keyed-hash message authentication code) using the known key. By creating a malicious ci session cookie, attackers can bypass authentication checks performed by the is login() and mso check allow() functions to gain administrator privileges.

Recommendations Update MaxSite CMS to a version newer than 109.6. As a temporary mitigation, change the hardcoded session encryption key in the application/config/config.php file.