The vulnerability exists in liufee FeehiCMS up to version 2.1.1 and is located in the environments/prod/backend/config/main‑local.php file that processes cookie validation. By manipulating the cookieValidationKey argument, an attacker can cause the application to use a hard‑coded cryptographic key, a flaw classified as CWE‑320 and CWE‑321. This allows forged authentication cookies to be accepted, enabling an attacker to impersonate users or gain unauthorized access to the system. The impact is a loss of confidentiality and integrity for authenticated sessions, potentially allowing full account takeover.

The vulnerability affects all installations of liufee FeehiCMS up to version 2.1.1 that deploy the default main‑local.php configuration, because the hard‑coded cookieValidationKey resides in that file.

The flaw carries a CVSS score of 5.3, indicating a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be carried out remotely; public exploits have been released, and the vendor has not yet responded with a fix. An attacker can remotely manipulate cookie values and produce forged authentication tokens, thereby bypassing the system’s authentication checks.