MaxSite CMS versions through 109.6 ship with a hardcoded session encryption key placed in application/config/config.php that is never regenerated during installation. The key is publicly known and can be used to compute an HMAC-SHA1 signature for a ci_session cookie. An attacker can forge a cookie that contains administrator privileges, bypassing the authentication checks performed by is_login() and mso_check_allow(). This vulnerability, an instance of CWE-321, allows an unauthenticated attacker to gain full administrative access to the CMS, enabling data disclosure, modification, and persistence of a compromised site.

The flaw affects any installation of MaxSite CMS up to and including version 109.6. All users who have not upgraded beyond this release, or who have retained the default configuration, are potentially vulnerable.

With a high CVSS score of 9.3 the risk of exploitation is significant, although the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, but its severity and the public visibility of the encryption key make it an attractive target. An attacker only needs to craft a valid session cookie containing administrator privileges; no additional network access or privileged credentials are required. The attack can be performed by any entity that can deliver a crafted HTTP request to the vulnerable site, typically from the public internet.