Security56 mOctober 24, 2026, 12:03

Rejetto HFS signs admin session cookie with Math.random() (CVE-2026-61500)

In HFS 3.0.0–3.2.0 the session cookie signing key is derived from JavaScript's Math.random(), and the generator's output is exposed to unauthenticated clients during login. Attackers can reconstruct the generator state, forge an admin cookie and execute code via server_code. The flaw is rated CVSS 9.3 and fixed in HFS 3.2.1.

DEV Community

Open source

HFS 3.0.0–3.2.0 affected; fix shipped in 3.2.1
CVSS 4.0 score 9.3, classified as CWE-338
Forged admin cookie enables code execution via server_code
ZoomEye: up to 61,861 HFS matches, versions not identifiable remotely

#Rejetto#HFS

Anthropic's Mythos AI found a critical Rejetto HFS flaw now exploited in the wild

Software

Nuxt 4.6 adds useSession: server sessions in a sealed cookie, no database

Security

Fake WatchGuard VPN site steals admin credentials while serving signed client

Security

Rejetto HFS signs admin session cookie with Math.random() (CVE-2026-61500)

Anthropic's Mythos AI found a critical Rejetto HFS flaw now exploited in the wild

Nuxt 4.6 adds useSession: server sessions in a sealed cookie, no database

Fake WatchGuard VPN site steals admin credentials while serving signed client

Microsoft tells admins to migrate Entra ID users to passkeys before SMS sign-in ends