Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-61500 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:9.1 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CNA: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/rejetto/hfs/releases/tag/v3.2.1	[email protected]	Release NotesVendor
https://www.vulncheck.com/advisories/rejetto-hfs-session-forgery-via-predictable-signing-key	[email protected]	AdvisoryRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-338	Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	[email protected]

Affected Products

Product	Versions
Rejetto HFS	>= 3.0.0, <= 3.2.0 (semver)
CPE cpe:2.3:a:rejetto:http_file_server:::::::: Remediation Upgrade: 3.2.1moderate efforthttps://github.com/rejetto/hfs/releases/tag/v3.2.1

Change History

3 change records found show changes

Date	Action	Recorded By
Jul 15, 2026	CVE Modified	CISA-ADP
Jul 14, 2026	CVE Modified	[email protected]
Jul 13, 2026	New CVE Received	[email protected]