Is CVE-2026-87929 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87929 being exploited in the wild.

How severe is CVE-2026-87929?

Critical severity, with a CVSS score of 9.8, published 9 September 2026.

Is there a fix for CVE-2026-87929?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87929 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-87929?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87929: MaxSite CMS hardcoded session encryption key auth bypass

CVE-2026-87929 · Severity: critical · CVSS 9.8 · Published 2026-09-09

MaxSite CMS is a content management system for websites and blogs. An attacker can forge administrator session cookies without credentials because the application uses a hardcoded, publicly known encryption key that is never changed during installation. This allows an unauthenticated attacker to gain full administrative access to any MaxSite CMS instance.

Quick answers

Is CVE-2026-87929 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87929 being exploited in the wild.
How severe is CVE-2026-87929?: Critical severity, with a CVSS score of 9.8, published 9 September 2026.
Which products and versions are affected?: MaxSite CMS through 109.6.
Is there a fix for CVE-2026-87929?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87929 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-87929?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability combines three defects: (1) the session encryption key is hardcoded as 'encryption key' in application/config/config.php and never changed by the installer, (2) sessions are stored in ci_session cookies as PHP-serialized data signed with only HMAC-SHA1 using the public key, allowing attackers to forge cookies with arbitrary contents like userlogged=1 and users_groups_id=1, and (3) the database re-validation in init.php passes malformed ciphertext (which decrypts to boolean false) directly to database queries, causing MySQL to match the administrator row. An unauthenticated network attacker can forge a valid administrator session cookie and access the admin panel without any credentials. Versions 109.6 and earlier using CodeIgniter 2.x session handling are affected.

Affected products

MaxSite CMS through 109.6

Timeline

2026-09-09: disclosed
2026-09-08: other: Advisory published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.