MaxSite CMS through version 109.6 ships with a hardcoded session encryption key that is never rotated at install, letting unauthenticated attackers mint valid administrator session cookies and take over the site.
What Is It
MaxSite CMS ships application/config/config.php with a session encryption key baked into the distributed source. Installation never changes it, so every default deployment shares the same publicly known secret.
Because the key is public, an attacker can compute a valid HMAC-SHA1 over a crafted ci_session cookie and hand themselves administrator privileges. The forged cookie satisfies the checks in the is_login() and mso_check_allow() functions, bypassing authentication entirely. No credentials, no user interaction, no prior access required; just an HTTP request to the target.
The issue is tracked as CWE-321 (Use of Hard-coded Cryptographic Key) and was disclosed via VulnCheck on 2026-09-09.
Why It Matters
VulnCheck, as the assigning CNA, scored the flaw 9.8 (CRITICAL) on CVSS v3.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and 9.3 (CRITICAL) on CVSS v4.0. Because the record was published today, NVD has not yet completed its own analysis, so these scores are CNA-supplied rather than NVD-assigned and may change once enrichment lands.
Every dimension favors the attacker: network attack vector, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability. Full administrative control over a CMS generally means content manipulation, data theft, and a foothold for further code execution.
There is no CISA KEV entry for this CVE, so active exploitation has not been confirmed by KEV at this time.
What's Vulnerable
- Vendor/Product: MaxSite; MaxSite CMS
- Affected versions: 0.78 through 109.6 (inclusive)
- Repository:
https://github.com/maxsite/cms(pkg:github/maxsite/cms)
The CVE record carries the tag unsupported-when-assigned, indicating the affected software was not under vendor support at the time of assignment. No fixed version is listed in the supplied data.
Patch Status
The advisory lists no patched release and no vendor remediation. Given the unsupported-when-assigned tag, operators should not expect an upstream fix and should treat exposed instances accordingly; rotate the session encryption key manually, restrict administrative endpoints, or retire the deployment.