Critical Flaw in Rejetto HFS Allows Authentication Bypass via Cookie Forgery
Threat actors are actively exploiting a critical vulnerability in Rejetto HTTP File Server (HFS) that enables authentication bypass and remote code execution (RCE), according to a warning from VulnCheck. The flaw, tracked as CVE-2026-61500 with a CVSS score of 9.3, stems from how the open-source file server handles session cookie generation.
The vulnerability arises because Rejetto HFS discloses the outputs of its non-cryptographic session cookie generator to unauthenticated clients during the login process. Furthermore, the server derives the session-cookie signing key from the same generator, creating a critical link between exposed data and cryptographic security.
This information leak allows attackers to collect enough outputs from the generator to reconstruct its internal state and recover the signing key. With the signing key in hand, an attacker can forge valid administrator session cookies, granting elevated privileges on the server.
How the Flaw Enables Remote Code Execution
Once administrative access is obtained via forged cookies, attackers can leverage the server’s server_code configuration feature to execute arbitrary code, resulting in full remote code execution. This chain — from information disclosure to cookie forgery to RCE — represents a complete compromise of affected HFS instances.
The root cause lies in Rejetto HFS’s reliance on JavaScript’s Math.random() function, which uses the xorshift128+ algorithm to generate values later passed to the Koa web framework for signing session cookies. Although designed to appear random, the xorshift128+ algorithm is deterministic and reversible, meaning observed outputs can be used to predict past and future values.
As explained by Horizon3.ai in a technical report, an attacker who collects a small set of login responses containing these generator outputs can reverse the process to reconstruct the generator’s state and extract the signing key used to sign session cookies.
AI-Assisted Discovery and Timeline of Disclosure
The vulnerability was uncovered by researchers at Horizon3.ai using Anthropic’s Mythos AI model, which applied advanced mathematical reasoning to identify that the outputs of Math.random() could be reversed to recover the secret session-cookie signing key. This highlights the growing role of AI in accelerating vulnerability discovery, particularly in identifying subtle cryptographic weaknesses in seemingly benign components.
Horizon3.ai reported discovering the weakness in June 2026. In response, Rejetto released version 3.2.1 of HFS on July 13, 2026, which included the necessary patches to address the issue. The advisory noted that "multiple security vulnerabilities have been found in all previous versions, potentially allowing an attacker to gain administrative access to HFS."
Active Exploitation Observed in October 2026
On October 2, 2026, VulnCheck issued a warning that hackers had begun actively targeting CVE-2026-61500 as part of small-scale reconnaissance efforts. The observed attack traffic originated from a China Telecom IP address and targeted canary devices deployed in Japan and the United States.
These canary hits indicate that threat actors are probing for vulnerable HFS installations in preparation for broader exploitation campaigns. The activity underscores the importance of timely patching, especially for internet-exposed services like HFS that are commonly used for file sharing in both personal and organizational contexts.
Organizations running Rejetto HFS are strongly advised to upgrade to version 3.2.1 or later immediately. Environments where immediate patching is not feasible should consider restricting network access to the HFS interface, monitoring for anomalous login patterns, and implementing additional authentication layers where possible.
Source: SecurityWeek