CVE-2026-87929 Overview
CVE-2026-87929 is an authentication bypass vulnerability in MaxSite CMS through version 109.6. The application ships with a hardcoded session encryption key in application/config/config.php that is never rotated during installation. Unauthenticated attackers can forge administrator session cookies by computing an HMAC-SHA1 signature using the publicly known key, then submitting the crafted ci_session cookie to bypass the is_login() and mso_check_allow() authentication checks. The flaw is classified as [CWE-321: Use of Hard-coded Cryptographic Key].
Critical Impact
Unauthenticated attackers can forge valid administrator session cookies and gain full control of any default MaxSite CMS installation reachable over the network.
Affected Products
- MaxSite CMS versions up to and including 109.6
- Default installations using the shipped application/config/config.php
- Deployments that never rotated the built-in session encryption key
Discovery Timeline
- 2026-09-09 - CVE-2026-87929 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87929
Vulnerability Analysis
MaxSite CMS derives its session integrity from a single symmetric key stored in application/config/config.php. The installer does not regenerate this key, so every out-of-the-box deployment shares the same secret published in the public MaxSite CMS repository. Because the session layer authenticates cookies with HMAC-SHA1 over attacker-controlled session data, knowledge of the key is sufficient to mint arbitrary sessions.
The session validation logic in application/maxsite/common/core/init.php trusts any ci_session cookie whose HMAC matches. An attacker can therefore populate the session payload with an administrator identity, sign it with the known key, and submit it to the target. The server's is_login() and mso_check_allow() gates accept the forged session and grant administrative access without a password.
Root Cause
The root cause is a hard-coded cryptographic secret shipped in source control and reused across all installations. The install workflow lacks a step to generate a per-instance encryption key, so the confidentiality property of session HMACs collapses. Details of the affected code are documented in the VulnCheck advisory and the GitHub CVE analysis.
Attack Vector
Exploitation requires only network access to the MaxSite CMS web interface. An attacker retrieves the encryption key from the public repository, serializes a session structure that marks the user as an administrator, and computes the HMAC-SHA1 tag using the known key. The attacker then sends an HTTP request to any administrator endpoint with the forged ci_session cookie. The server validates the signature, treats the request as authenticated, and returns administrative functionality. No user interaction, prior credentials, or elevated privileges are needed.
No verified proof-of-concept code is published in the enriched data. Refer to the GitHub config snippet and the init.php snippet for the vulnerable code paths.
Detection Methods for CVE-2026-87929
Indicators of Compromise
- Unexpected ci_session cookies presented by clients that never completed an interactive login flow.
- Administrator actions in MaxSite CMS logs originating from IP addresses with no prior authentication events.
- New or modified administrator accounts, plugins, or theme files created outside of change-management windows.
Detection Strategies
- Compare the deployed application/config/config.php encryption key against the value in the public MaxSite CMS repository and flag any match.
- Inspect web server access logs for direct requests to administrative routes accompanied by a ci_session cookie but no preceding /login POST.
- Correlate session identifiers with source IP and user-agent history to surface sessions that appear fully privileged from first observation.
Monitoring Recommendations
- Enable verbose authentication and authorization logging in MaxSite CMS to capture is_login() and mso_check_allow() outcomes.
- Forward web server and application logs to a centralized analytics platform and alert on administrator activity from unrecognized sessions.
- Monitor file integrity on application/config/config.php, plugin directories, and theme directories to detect post-exploitation changes.
How to Mitigate CVE-2026-87929
Immediate Actions Required
- Rotate the $MSO['encryption_key'] value in application/config/config.php to a cryptographically random 32+ byte string on every installation.
- Invalidate all existing sessions after rotation to force re-authentication of legitimate users.
- Restrict administrative endpoints by IP allowlist or reverse-proxy authentication until the key has been rotated.
Patch Information
No fixed version is listed in the enriched CVE data at time of publication. Track the MaxSite CMS repository and the VulnCheck advisory for updates. Until a vendor patch is available, treat key rotation as the primary remediation.
Workarounds
- Replace the shipped encryption key with a unique, high-entropy secret and redeploy the application.
- Place the CMS behind a web application firewall (WAF) rule that requires an additional shared secret header on /admin routes.
- Remove or disable the administrative interface on internet-exposed instances until keys have been rotated and sessions invalidated.
# Generate a strong replacement key and update config.php
NEW_KEY=$(openssl rand -hex 32)
sed -i "s|\$MSO\['encryption_key'\] = '.*';|\$MSO['encryption_key'] = '${NEW_KEY}';|" \
application/config/config.php
# Invalidate existing sessions (adjust path to your session store)
rm -f application/maxsite/sessions/*
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
