Vulnerabilities · 2h ago

Rejetto HFS Cookie Forgery Opens Remote Code Execution

VulnCheck said Rejetto HTTP File Server (HFS) CVE-2026-61500 is seeing exploitation attempts after a public Python proof of concept showed how to forge administrator sessions on HFS 3.0.0 through 3.2.0. The flaw was already patched in 3.2.1, but the new code lowered the barrier from lab finding to workable attack.

The bug sits in how HFS makes and reveals login state: it derives the session-signing key from JavaScript Math.random() and leaks outputs from that same generator during login. With a few observed responses, an attacker can reconstruct the generator’s state, recover the key, mint a valid admin cookie, and then use the server_code feature to run server-side JavaScript.

That leaves exposed HFS instances with a trust problem, not just a version problem: if an attacker can see the login exchange, they may be able to impersonate admin before any obvious malware or brute-force signs appear. For internet-facing deployments, the practical exposure is forged administration followed by code execution, not a simple login bypass.

CVE-2026-61500

NVD KEV

CVSS 9.8 CRITICAL: rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random()… EPSS 1.0% (61st percentile).

Timeline

Oct 5 Reported by SecurityWeek
Oct 3 Reported by The Register Security

Sources

3 sources covering this story

SecurityWeek Oct 5
Exploitation Hits Rejetto HFS Vulnerability Discovered by AI
CVE-2026-61500 allows attackers to recover the session-cookie signing key and gain administrative access and RCE.
The Hacker News Oct 5
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
Rejetto HFS CVE-2026-61500 faces exploitation attempts after a public PoC showed forged admin sessions can lead to remote code execution.
The Register Security Oct 3
Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows
Exploitation attempts came from China-hosted IP, VulnCheck researcher says

Entities

CVE-2026-61500

Part of the PlainSec briefing for 2026-10-05

Editions

Briefing for 2026-10-05

Vulnerabilities · 2h agoRejetto HFS Cookie Forgery Opens Remote Code ExecutionVulnCheck said Rejetto HTTP File Server (HFS) CVE-2026-61500 is seeing exploitation attempts after a public Python proof of concept showed how to forge administrator sessions on HFS 3.0.0 through 3.2.0. The flaw was already patched in 3.2.1, but the new code lowered the barrier from lab finding to workable attack.The bug sits in how HFS makes and reveals login state: it derives the session-signing key from JavaScript Math.random() and leaks outputs from that same generator during login. With a few observed responses, an attacker can reconstruct the generator’s state, recover the key, mint a valid admin cookie, and then use the server_code feature to run server-side JavaScript.That leaves exposed HFS instances with a trust problem, not just a version problem: if an attacker can see the login exchange, they may be able to impersonate admin before any obvious malware or brute-force signs appear. For internet-facing deployments, the practical exposure is forged administration followed by code execution, not a simple login bypass.

CVE-2026-61500

NVD KEV

CVSS 9.8 CRITICAL: rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random()… EPSS 1.0% (61st percentile).