Rejetto HFS vulnerability CVE-2026-61500 exploited in the wild, can forge admin sessions and achieve RCE
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
AI summary
Rejetto HTTP File Server (HFS) 3.0.0 through 3.2.0 has session forgery vulnerability CVE-2026-61500 (CVSS 9.3): its session cookie signing key is generated by non-cryptographic Math.random(), allowing attackers to collect a small number of login responses to reconstruct the PRNG state, recover the signing key, forge admin sessions, and achieve remote code execution via the server_code configuration. The vulnerability was discovered by Anthropic's Mythos model, fixed in version 3.2.1 in July 2026, with a public Python PoC released at the end of September; VulnCheck detected in-the-wild exploitation attempts against real hosts in the United States on October 1.