CVE-2026-87929
MaxSite CMS versions up to 109.6 use a hard‑coded session encryption key that is publicly known. This allows attackers to compute an HMAC‑SHA1 and forge a ci_session cookie that logs them in as an administrator without any authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running MaxSite CMS 109.6 or earlier.
Real-world impact
An attacker can create a forged admin session cookie, gaining full control of the site—able to modify content, install malware, or exfiltrate data.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability gives attackers complete confidentiality, integrity, and availability compromise with no authentication required, enabling full administrative takeover.
What to do about it
- ›Monitor for unauthorized admin sessions and restrict admin access to trusted IP addresses.
- ›Consider using a web application firewall to block forged session cookies.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources