Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-61500 EUVD-2026-43505GHSA-xxrm-3f86-v97j

Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key

Published Jul 13, 2026 · Updated Oct 1, 2026 · Assigned by VulnCheck

Vendor: rejetto Product: hfs

Description

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

Affected products

VendorProductAffectedFixed
rejetto hfs 3.0.0 – < 3.2.1 3.2.1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • aramosf/CVE-2026-61500 ★ 0 · Sep 26, 2026

    CVE-2026-61500 Rejetto HFS predictable PRNG session forgery to RCE PoC and Docker lab

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References