Threat actors are exploiting a critical vulnerability in the Rejetto HTTP File Server (HFS) to bypass authentication and gain remote code execution (RCE), VulnCheck warns.
The flaw is tracked as CVE-2026-61500 (CVSS score of 9.3) and exists because the open source file server passes output from its non-cryptographic session cookie generator to unauthenticated clients during login. Additionally, the session cookie signing key is derived from the same generator.
The leak of sensitive information allows an attacker to reconstruct the state of the generator and recover the signing key using a small amount of collected login responses.
Using the recovered key, the attacker can then forge valid administrator session cookies to gain elevated access to the server and RCE via the server_code configuration function.
The problem was that Rejetto HFS’s generator, Math.random(), used the xorshift128+ algorithm to generate the “random” value, which was then passed to the server’s Node.js web framework Koa for signing session cookies.
Because the algorithm’s outputs are reversible, an attacker who can collect other numbers generated by Math.random() could determine other numbers generated and spoof the authentication cookies, cybersecurity firm Horizon3 explained in a statement Technical report.
Horizon3.ai researchers discovered the flaw using Anthropic’s Mythos AI model, which used advanced mathematical reasoning to detect that the PRNG outputs of Math.random() could be reversed to reconstruct the secret session cookie signing key.
The security company discovered the vulnerability in June and released Rejetto HFS version 3.2.1 with the necessary patches on July 13.
“Several security vulnerabilities were found in all previous versions that could potentially allow an attacker to gain administrative access to HFS,” Rejetto noted in his report advisory.
On October 2nd, VulnCheck warned that hackers have begun attacking CVE-2026-61500 as part of a small reconnaissance campaign originating from a China Telecom IP. The trials hit canaries in Japan and the US.
Related: Citrix NetScaler Zero-Day Exploitation Hits Appliances Patched Days Previously
Related: Fortra fixes critical vulnerabilities in BoKS
Related: Warlock expands SharePoint exploitation in attacks on critical infrastructure
Related: Fortinet FortiMail zero-day urgent action calls exploited
