CVE-2026-86241: FeehiCMS Hard-Coded Key RCE Vulnerability

CVE-2026-86241 Overview

CVE-2026-86241 affects liufee FeehiCMS up to version 2.1.1. The vulnerability resides in the environments/prod/backend/config/main-local.php file within the Cookie Validation component. FeehiCMS ships with a hard-coded cookieValidationKey value, mapped to [CWE-320: Key Management Errors]. Attackers who know or recover the static key can forge valid signed cookies against any default deployment. The exploit has been published, and the project maintainers have not yet responded to the upstream issue report.

Critical Impact
Remote attackers can leverage the hard-coded cryptographic key to forge signed cookies against unmodified FeehiCMS installations, undermining the integrity of session and CSRF validation.

Affected Products

liufee FeehiCMS versions up to and including 2.1.1
Deployments using the shipped environments/prod/backend/config/main-local.php configuration
Any FeehiCMS installation where cookieValidationKey was not manually rotated post-install

Discovery Timeline

2026-09-07 - CVE-2026-86241 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86241

Vulnerability Analysis

FeehiCMS is a PHP content management system built on the Yii2 framework. Yii2 uses the cookieValidationKey to HMAC-sign cookies so the framework can detect tampering. When this key is hard-coded and shipped inside a public repository, its confidentiality is destroyed at build time.

Because the key resides in environments/prod/backend/config/main-local.php, every operator deploying the project inherits the same secret unless they explicitly regenerate it. An attacker who reads the public source obtains the exact HMAC key used to validate cookies on production installs.

The issue is a classic use of a hard-coded cryptographic key rather than a memory-safety flaw. Exploitation requires network reach to the backend and some user interaction, but no authentication or privileges.

Root Cause

The root cause is the presence of a static, distribution-wide cookieValidationKey in the production configuration template. Yii2 documentation instructs developers to generate a unique random key per deployment. FeehiCMS did not enforce that step, so the shipped default persists in the wild.

Attack Vector

An attacker retrieves the cookieValidationKey from the public FeehiCMS repository. Using the known key, the attacker crafts and HMAC-signs cookies that the target FeehiCMS backend accepts as authentic. This enables cookie tampering and can facilitate downstream attacks against session state and CSRF protections. Technical details are documented in the GitHub CVE detail write-up and the upstream issue report.

No verified exploit code is reproduced here. See the VulDB entry for CVE-2026-86241 for additional context.

Detection Methods for CVE-2026-86241

Indicators of Compromise

Presence of the default cookieValidationKey string inside environments/prod/backend/config/main-local.php on production hosts
Backend authentication or CSRF logs showing signed-cookie acceptance from unexpected source IPs
Unexpected privilege changes or administrative actions without a corresponding valid login event

Detection Strategies

Scan filesystem and configuration management repositories for the FeehiCMS-shipped cookieValidationKey value.
Audit web server access logs for repeated backend requests carrying identical or replayed cookie signatures.
Correlate Yii2 framework logs with authentication events to identify sessions established without a preceding login flow.

Monitoring Recommendations

Alert on modifications to main-local.php and on deployments that push identical cookieValidationKey values across environments.
Monitor for anomalous administrative activity in the FeehiCMS backend, especially outside normal operator hours.
Track outbound requests from the FeehiCMS host that could indicate post-exploitation activity following cookie forgery.

How to Mitigate CVE-2026-86241

Immediate Actions Required

Regenerate cookieValidationKey in environments/prod/backend/config/main-local.php with a cryptographically random 32-byte value.
Invalidate all existing backend sessions and force administrators to re-authenticate after key rotation.
Restrict network exposure of the FeehiCMS backend interface to trusted management networks or a VPN.

Patch Information

At the time of publication, the FeehiCMS project has not released a fix and has not responded to the upstream GitHub issue. Operators must apply configuration hardening manually until a vendor patch is available. Refer to the VulDB report for update tracking.

Workarounds

Replace the shipped cookieValidationKey value with a per-deployment secret managed outside version control.
Store the key in an environment variable or secrets manager and load it at runtime rather than committing it to configuration files.
Add a deployment-time check that fails builds if cookieValidationKey matches the upstream default value.

bash

# Generate a strong replacement key and update the config safely
NEW_KEY=$(openssl rand -base64 32)
sed -i.bak "s|'cookieValidationKey' => '.*'|'cookieValidationKey' => '${NEW_KEY}'|" \
    environments/prod/backend/config/main-local.php