MaxSite CMS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/maxsite-cms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 09 Sep 2026 19:01:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHardcoded Session Encryption Key in MaxSite CMShttps://feed.craftedsignal.io/briefs/2026-09-maxsite-hardcoded-key/Wed, 09 Sep 2026 19:01:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-maxsite-hardcoded-key/MaxSite CMS versions 109.6 and earlier contain a hardcoded encryption key in application/config/config.php, enabling unauthenticated attackers to forge administrator session cookies.MaxSite CMS versions up to and including 109.6 are vulnerable to an authentication bypass due to a hardcoded session encryption key stored in the application/config/config.php file. Because this key remains static across all installations, an unauthenticated remote attacker can reconstruct the session cookie structure. By computing an HMAC-SHA1 signature using the discovered key, an attacker can generate a forged 'ci_session' cookie that grants administrator privileges. This flaw effectively bypasses critical authentication and authorization checks within the application's core functions, specifically is_login() and mso_check_allow(). This vulnerability presents a critical risk as it allows full unauthorized control of the CMS administrative interface.

Impact

Successful exploitation allows an unauthenticated remote attacker to gain full administrative access to the MaxSite CMS instance. This can lead to complete site takeover, unauthorized access to user data, modification of content, or the injection of malicious code into the web environment. The scope of targeting includes all public-facing instances of MaxSite CMS version 109.6 and below.

Recommendation

Prioritized actions for security and IT teams:

  • Upgrade MaxSite CMS to the latest version that remediates CVE-2026-87929.
  • Review web server access logs for anomalous session cookie patterns, specifically 'ci_session' tokens that differ in structure or origin from established baseline traffic.
  • Audit the 'application/config/config.php' file on all deployed instances to verify if a unique, site-specific encryption key has been configured, overriding the default.
]]>criticaladvisorywebcveauthentication-bypass