CVE-2026-87929 MaxSite CVE debrief

Who should care

Defenders responsible for MaxSite CMS installations should assess exposure and verify the integrity of their systems. This vulnerability may impact administrators and users relying on authentication mechanisms in MaxSite CMS.

Why it matters

CVE-2026-87929 is a critical vulnerability in MaxSite CMS through 109.6 due to a hardcoded session encryption key, allowing unauthenticated attackers to forge administrator session cookies and bypass authentication checks.

• Unauthenticated attackers can forge administrator session cookies
• Authentication checks in is_login() and mso_check_allow() functions can be bypassed
• Defenders need to verify the integrity of MaxSite CMS installations
• Changing or removing the hardcoded session encryption key is necessary

Technical summary

The MaxSite CMS through 109.6 contains a hardcoded session encryption key in the application/config/config.php file. This key is used for computing HMAC-SHA1 values for session cookies. An attacker can forge administrator session cookies using this publicly known key, bypassing authentication checks in the is_login() and mso_check_allow() functions. Defenders should prioritize verifying the integrity of their MaxSite CMS installations and ensuring that the hardcoded session encryption key is changed or removed to prevent unauthenticated attackers from exploiting this vulnerability.

Defensive priority

Defenders should prioritize verifying the integrity of their MaxSite CMS installations and ensuring that the hardcoded session encryption key is changed or removed.

Recommended defensive actions

• Verify the integrity of MaxSite CMS installations
• Change or remove the hardcoded session encryption key
• Monitor for potential authentication bypass attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate that MaxSite CMS through 109.6 has a hardcoded session encryption key, allowing unauthenticated attackers to forge administrator session cookies. However, the exact scope of affected versions and potential exploitation remain unclear.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.