Exploitation Hits Rejetto HFS Vulnerability Discovered by AI
Attackers are exploiting Rejetto HFS flaw CVE-2026-61500 to forge admin cookies and gain code execution.
VulnCheck says attackers are exploiting CVE-2026-61500, a CVSS 9.3 flaw in Rejetto HTTP File Server that can bypass authentication and lead to remote code execution. Login responses leak outputs from the non-cryptographic Math.random xorshift128+ generator, allowing an attacker to reconstruct its state, recover the Koa session-cookie signing key, forge administrator cookies, and execute code through the server_code feature. Horizon3.ai discovered the issue in June with Anthropic’s Mythos model, and Rejetto patched it in HFS 3.2.1 on July 13. On October 2, VulnCheck reported small-scale reconnaissance from a China Telecom address against canaries in Japan and the United States.
- CVE-2026-61500, scored CVSS 9.3, leaks Math.random session outputs.
- Attackers can recover the signing key and forge administrator cookies.
- Forged sessions allow remote code execution through server_code.
- Horizon3 found it with Anthropic Mythos; HFS 3.2.1 contains the fix.
- VulnCheck saw small-scale probing of canaries in Japan and the US.
Vulnerabilities mentionedAll →
- CVE-2026-615009.3<1%Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same…published PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-61500 | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same… |
Full article335 words · extracted from securityweek.com · click to collapse
Threat actors are exploiting a critical vulnerability in Rejetto HTTP File Server (HFS) to bypass authentication and gain remote code execution (RCE), VulnCheck warns.
Tracked as CVE-2026-61500 (CVSS score of 9.3), the flaw exists because the open source file server discloses outputs of its non-cryptographic session cookie generator to unauthenticated clients during login. It also derives the session-cookie signing key from the same generator.
The sensitive information leak allows an attacker to reconstruct the generator’s state and recover the signing key using a small set of collected login responses.
Using the recovered key, the attacker can then forge valid administrator session cookies to gain elevated access to the server and RCE via the server_code configuration feature.
The issue was that Rejetto HFS’s generator, Math.random(), was using the xorshift128+ algorithm to generate the ‘random’ value that was then passed to the server’s Node.js web framework Koa for signing session cookies.
Because the algorithm’s outputs are reversible, an attacker able to collect other numbers generated by Math.random() could determine other generated numbers and forge the authentication cookies, cybersecurity firm Horizon3 explained in a technical report.
Advertisement. Scroll to continue reading.
Horizon3.ai researchers uncovered the flaw using Anthropic’s Mythos AI model, which used advanced mathematical reasoning to recognize that Math.random() PRNG outputs could be reversed to reconstruct the secret session-cookie signing key.
The security firm discovered the weakness in June, and Rejetto HFS version 3.2.1 was released on July 13 with the necessary patches.
“Multiple security vulnerabilities have been found in all previous versions, potentially allowing an attacker to gain administrative access to HFS,” Rejetto noted in its advisory.
On October 2, VulnCheck warned that hackers have begun targeting CVE-2026-61500 as part of small-scale reconnaissance originating from a China Telecom IP. The attempts hit canaries in Japan and the US.
Related: Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
Related: Fortra Patches Critical Vulnerabilities in BoKS
Related: Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
Related: Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action