CVE-2026-87929 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key
Attackers can forge administrator session cookies using a hardcoded encryption key to bypass authentication and gain full control of MaxSite CMS installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-87929?
CVE-2026-87929 is a critical vulnerability in MaxSite CMS, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions.
Weakness: CWE-321
Which versions are affected by CVE-2026-87929?
How do I fix CVE-2026-87929?
No fix has been published for CVE-2026-87929 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-87929 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87929 exists.
Sources
Also known as GHSA-x43r-8q5x-82p8.