CVE-2026-86241
Received Received - Intake

Hard-Coded Cryptographic Key in FeehiCMS

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86241
EUVD
EUVD-2026-72190

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
liufee feehi_cms to 2.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.
CWE-320 Key Management Errors

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects FeehiCMS up to version 2.1.1 due to an empty hard-coded cryptographic key called cookieValidationKey in the cookie validation component. The Yii2 framework uses this key to sign HTTP cookies with HMAC-SHA256 to prevent tampering. With an empty key, attackers can forge any cookie managed by Yii2's cookie component, potentially leading to authentication bypass or CSRF token forgery.

Detection Guidance

Check FeehiCMS environment files for an empty cookieValidationKey in environments/prod/backend/config/main-local.php and similar files. Use commands like grep -r "cookieValidationKey => ''" /path/to/feehi_cms to search for hard-coded empty keys.

Impact Analysis

Attackers could exploit this to forge cookies, allowing them to impersonate users without credentials if enableAutoLogin is enabled. They could also bypass CSRF protections by forging tokens. Docker deployments are particularly vulnerable as they use the empty key by default.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's integrity and confidentiality requirements and HIPAA's access controls. Organizations using FeehiCMS may face compliance violations if attackers exploit the flaw to access protected data.

Mitigation Strategies

Generate a random cookieValidationKey for all environment files and Docker deployments. Update the init script to auto-generate and validate the key. Disable enableAutoLogin if not required to prevent authentication bypass.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart