Hardcoded Session Encryption Key in MaxSite CMS

MaxSite CMS versions up to and including 109.6 are vulnerable to an authentication bypass due to a hardcoded session encryption key stored in the application/config/config.php file. Because this key remains static across all installations, an unauthenticated remote attacker can reconstruct the session cookie structure. By computing an HMAC-SHA1 signature using the discovered key, an attacker can generate a forged 'ci_session' cookie that grants administrator privileges. This flaw effectively bypasses critical authentication and authorization checks within the application's core functions, specifically is_login() and mso_check_allow(). This vulnerability presents a critical risk as it allows full unauthorized control of the CMS administrative interface.

Impact

Successful exploitation allows an unauthenticated remote attacker to gain full administrative access to the MaxSite CMS instance. This can lead to complete site takeover, unauthorized access to user data, modification of content, or the injection of malicious code into the web environment. The scope of targeting includes all public-facing instances of MaxSite CMS version 109.6 and below.

Recommendation

Prioritized actions for security and IT teams:

• Upgrade MaxSite CMS to the latest version that remediates CVE-2026-87929.
• Review web server access logs for anomalous session cookie patterns, specifically 'ci_session' tokens that differ in structure or origin from established baseline traffic.
• Audit the 'application/config/config.php' file on all deployed instances to verify if a unique, site-specific encryption key has been configured, overriding the default.