CVE-2026-86241: Use of Hard-coded Cryptographic Key in liufee FeehiCMS

This vulnerability in liufee FeehiCMS up to version 2.1.1 arises from the use of a hard-coded cryptographic key in the cookieValidationKey argument located in environments/prod/backend/config/main-local.php. The weakness affects the Cookie Validation component, potentially allowing remote attackers to exploit the predictable cryptographic key. The issue was reported early to the project, but no vendor response or patch has been provided. Public exploit code exists, increasing the risk of exploitation.

The use of a hard-coded cryptographic key weakens the security of cookie validation, potentially allowing attackers to forge or manipulate cookies remotely. This can lead to unauthorized actions or session tampering. However, the CVSS score of 5.3 indicates a medium impact, and there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider mitigating risks by restricting access to affected systems and reviewing cookie validation configurations if possible.