CVE-2026-86241 Details
Description
A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in FeehiCMS versions through 2.1.1, where the 'cookieValidationKey' is set to an empty string in all environment templates, including production. This key is crucial for signing HTTP cookies to prevent tampering. The absence of a valid key allows for the forgery of cookies managed by Yii2's cookie component. The vulnerability is present in both the production and development environment templates, and affects all Docker deployments by default.
Users can manually set a secure 'cookieValidationKey' in the configuration files or modify the Docker entrypoint script to generate a random key and replace the empty default. However, these steps require careful implementation to ensure the key is both secure and properly integrated into the application's cookie management.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/liufee/cms/issues/96 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/yang5ynag/cve/blob/main/FEHI-003-Empty-cookieValidationKey.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-86241 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/901836 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399398 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/399398/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-320 | Key Management Errors | [email protected] |
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| liufee FeehiCMS | <= 2.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |