Reported by 7 outlets
CVE-2026-61500 Rejetto HFS critical session-key flaw
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.01 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Desk analysis
CVE-2026-61500, CVSS 9.3, covers Rejetto HTTP File Server 3.0.0 through 3.2.0. The server derives its session-cookie signing key from Math.random(), which uses the reversible xorshift128+ algorithm, and discloses outputs of the same generator to unauthenticated clients during login. An attacker collects a small set of login responses, reconstructs the generator state, recovers the signing key, and forges a valid administrator session cookie, then reaches remote code execution through the server_code configuration feature.
Horizon3 researchers uncovered the flaw using Anthropic's Mythos AI model, which recognized that the Math.random() outputs could be reversed. The issue was fixed in Rejetto HFS 3.2.1 and first published on July 13, 2026. VulnCheck's Canary Intelligence honeypots have since observed probing of the flaw: Caitlin Condon, VulnCheck's VP of security research, described small-scale reconnaissance from a single China Telecom IP address against deployments in Japan and the United States. BleepingComputer reports HFS servers are now actively scanned.
The path from session forgery to RCE makes internet-exposed HFS instances high-value targets, and the tool is widely used for self-hosted file sharing on Windows, Linux, and macOS. Watch for scanning volume scaling beyond reconnaissance, public exploit releases, and any observed abuse of the server_code feature. Admins should upgrade to 3.2.1 or later and remove unnecessary instances from the public internet.
Timeline
-
original reporting
🤖 CVE-2026-61500 (CVSS 9.3): critical flaw in Rejetto HTTP File Server (HFS). A weak PRNG makes the session key predictable, letting an atta
thehackernews.com · 8d ago · October 5th, 2026
🤖 CVE-2026-61500 (CVSS 9.3): critical flaw in Rejetto HTTP File Server (HFS). A weak PRNG makes the session key predictable, letting an atta
via Mastodon https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html
-
update from securityweek.com
Exploitation Hits Rejetto HFS Vulnerability Discovered by AI
securityweek.com · 8d ago · October 5th, 2026
Threat actors are exploiting a critical vulnerability in Rejetto HTTP File Server (HFS) to bypass authentication and gain remote code execution (RCE), VulnCheck warns. Tracked as CVE-2026-61500 (CVSS score of 9.3), the flaw exists because the open source file server discloses outputs of its non-cryptographic session cookie generator to unauthenticated clients during login. It also derives the session-cookie signing key from the same generator. The sensitive information leak allows an attacker to reconstruct the generator’s state and recover the signing key using a small set of collected login responses. Using the recovered key, the attacker can then forge valid administrator session cookies to gain elevated access to the server and RCE via the server_code configuration feature. The issue was that Rejetto HFS’s generator, Math.random(), was using the xorshift128+ algorithm to generate the ‘random’ value that was then passed to the server’s Node.js web framework Koa for signing session cookies. Because the algorithm’s outputs are reversible, an attacker able to collect other numbers generated by Math.random() could determine other generated numbers and forge the authentication cookies, cybersecurity firm Horizon3 explained in a technical report . Horizon3.ai researchers uncovered the flaw using Anthropic’s Mythos AI model, which used advanced mathematical reasoning to recognize that Math.random() PRNG outputs could be reversed to recon
-
update from bleepingcomputer.com
Rejetto HFS servers now actively scanned for critical RCE flaw
bleepingcomputer.com · 8d ago · October 5th, 2026
VulnCheck VP of Security Research Caitlin Condon posted on LinkedIn over the weekend that the company's Canary Intelligence honeypots had observed probes targeting CVE-2026-61500. Condon said the observed activity appears to be small-scale reconnaissance from a single China Telecom IP address probing deployments in Japan and the United States. Rejetto HFS (HTTP File Server) is a free and open-source file-sharing server tool used for self-hosted file sharing on Windows, Linux, and macOS. CVE-2026-61500, first published on July 13, 2026 , is a session-cookie signing weakness and leakage issue fixed in Rejetto HFS version 3.2.1.
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-61500: Rejetto HFS 3.0.0–3.2.0 derives its session-cookie signing key from Math.random() and leaks PRNG outputs to unauthenticate
www.bleepingcomputer.com · 8d ago · October 5th, 2026
-
mentioned by threatnoir.com
⚠️ CRITICAL: Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE Rejetto HFS vulnerability CVE-2026-61500 allows at
threatnoir.com · 7d ago · October 6th, 2026
-
mentioned by nvd.nist.gov
🤖 CVE-2026-61500 (CVSS 9.3): Rejetto HFS 3.0.0–3.2.0 derives its session-cookie signing key from Math.random() and leaks generator output to
nvd.nist.gov · 7d ago · October 6th, 2026
-
update from meterpreter.org
Discover how Anthropic's Mythos AI synthesized a remote code execution exploit for Rejetto HFS, exposing CVE-2026-61500 through mathematical
meterpreter.org · 7d ago · October 6th, 2026
Discover how Anthropic's Mythos AI synthesized a remote code execution exploit for Rejetto HFS, exposing CVE-2026-61500 through mathematical
via Mastodon https://meterpreter.org/anthropic-mythos-ai-rejetto-hfs-cve-2026-61500/?utm_source=mastodon&utm_medium=jetpack_social
-
update from beyondmachines.net
Vulnerability in Rejetto HFS Leads to Remote Code Execution, Actively Exploited A critical authentication bypass is reported in Rejetto HFS
beyondmachines.net · 7d ago · October 6th, 2026
Vulnerability in Rejetto HFS Leads to Remote Code Execution, Actively Exploited A critical authentication bypass is reported in Rejetto HFS
via Mastodon https://beyondmachines.net/event_details/vulnerability-in-rejetto-hfs-leads-to-remote-code-execution-actively-exploited-h-m-g-z-y/gD2P6Ple2L
-
update from www.bleepingcomputer.com
# Rejetto # HFS servers now actively scanned for critical RCE flaw https://www. bleepingcomputer.com/news/secu rity/rejetto-hfs-servers-now-
www.bleepingcomputer.com · 7d ago · October 6th, 2026
Rejetto # HFS servers now actively scanned for critical RCE flaw https://www.