Executive brief
FeehiCMS, a content management system, ships with an empty cryptographic key used to sign and validate HTTP cookies. This weakness allows attackers to forge session cookies and bypass authentication, potentially gaining unauthorized access to user accounts and sensitive data. The vulnerability affects all production and development deployments, including Docker-based installations.
Technical details
The vulnerability is a use of a hard-coded (specifically, empty) cryptographic key in the Yii2 framework's cookie validation component. The vulnerable configuration exists in environments/prod/backend/config/main-local.php and equivalent frontend/dev environment files, where the cookieValidationKey parameter is left empty by default. Yii2 uses this key to sign cookies via HMAC-SHA256; an empty key means any cookie can be forged remotely without authentication. The Docker deployment entry point does not auto-generate a random key, ensuring all containerized instances are vulnerable by default. An attacker can forge arbitrary cookies to impersonate users and escalate privileges.
Affected products
- liufee FeehiCMS up to 2.1.1
Timeline
- 2026-07-22: disclosed: Issue opened on GitHub
- 2026-09-07: advisory: CVE-2026-86241 published