CVE-2026-85181 Details
Description
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
A vulnerability in Dianping CAT versions through 3.1.0 allows for session cookie forgery that can lead to unauthorized admin access. The issue arises because CAT's session cookie integrity relies solely on Java's String.hashCode() without any server-side keying. This flaw enables attackers to compute valid cookie checksums offline. Additionally, the vulnerability is exacerbated by CAT's use of the X-Forwarded-For header to determine the client's IP address, which can be manipulated to bypass IP binding checks. As a result, attackers can create forged admin sessions with full access to configuration endpoints.
Replace the hashCode() function with a cryptographically secure hash function, such as HMAC-SHA256, and store a server-side secret to validate the cookie integrity. Additionally, revise the IP binding logic to rely solely on the request's remote address, excluding proxy headers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dianping/cat | [email protected] | Vendor |
| https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/system/page/login/service/TokenBuilder.java | [email protected] | Source CodeVendor |
| https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/util/HttpUtils.java | [email protected] | Source CodeVendor |
| https://github.com/dianping/cat/issues/2384 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/cat-through-3.1.0-session-cookie-forgery-via-unkeyed-hashcode-checksum | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-565 | Reliance on Cookies without Validation and Integrity Checking | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dianping CAT | <= 3.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |