CVE-2026-61500criticalobserved exploitationCWE-338

CVE-2026-61500: critical vulnerability in rejetto hfs

Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key

Published · Updated

Follow this CVE+ Monitor hfs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck, has an official Brazilian government alert and has a public proof of concept.

ssvc Actcvss 9.3epss 1.9%
from disclosure to weapon75 days
Published on NVDJul 13
1st PoC+75d
VulnCheck+80d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
rejetto · hfs
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — rejetto hfs

In the same product, most dangerous first.

CVE-2026-61505MEDIUMRejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang ParameterEPSS 0.5%CVE-2026-61503MEDIUMRejetto HFS < 3.2.1 Username Enumeration via Login Response DifferencesEPSS 0.4%CVE-2026-61501MEDIUMRejetto HFS < 3.2.1 Stored XSS in Admin Log ViewerEPSS 0.4%CVE-2026-61504MEDIUMRejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web ListingEPSS 0.2%CVE-2026-61502MEDIUMRejetto HFS < 3.2.1 Cross-Site Request Forgery via GET RequestsEPSS 0.2%