CVE-2026-61500
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
- Published Jul 13, 2026
- CVSS 9.3 critical
- 1.0% chance of exploitation in the next 30 days (EPSS)
- A fix is available
Affected software
In the news
- Rejetto HFS servers now actively scanned for critical RCE flaw BleepingComputer ·
- ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests The Hacker News ·
- Exploitation Hits Rejetto HFS Vulnerability Discovered by AI SecurityWeek ·
- Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE The Hacker News ·