FeehiCMS 2.1.1 ships with an empty cookieValidationKey in all environment templates, including production. The Yii2 framework uses this key to sign HTTP cookies via HMAC-SHA256, preventing tampering. An empty key means any cookie managed by Yii2's cookie component can be forged by an attacker.
The vulnerability affects all four environment templates (environments/prod/backend/config/main-local.php, environments/prod/frontend/config/main-local.php, and their dev equivalents). The Docker deployment (docker-entrypoint.sh) does not auto-generate a random key, meaning all Docker deployments use the empty key by default.
FeehiCMS 2.1.1 ships with an empty cookieValidationKey in all environment templates, including production. The Yii2 framework uses this key to sign HTTP cookies via HMAC-SHA256, preventing tampering. An empty key means any cookie managed by Yii2's cookie component can be forged by an attacker.
The vulnerability affects all four environment templates (environments/prod/backend/config/main-local.php, environments/prod/frontend/config/main-local.php, and their dev equivalents). The Docker deployment (docker-entrypoint.sh) does not auto-generate a random key, meaning all Docker deployments use the empty key by default.