CVE-2026-61500
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.86%
- CWE
- CWE-338
- Published
- 2026-07-13
- Last modified
- 2026-07-15
Affected products
- rejetto hfs
Weakness type
Related vulnerabilities
- CVE-2026-74887 — openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module
- CVE-2026-74874 — openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection
- CVE-2026-73567 — sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
- CVE-2026-18611 — Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials
- CVE-2026-71851 — crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
- CVE-2026-9205 — Langflow is affected by weaknesses in secret handling and sensitive configuration access
- CVE-2026-64798 — Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension
- CVE-2026-16615 — Librest: weak random number generation in pkce implementation