# Rejetto HTTP File Server (HFS) 3.x session forgery via predictable Math.random() signing key leads to unauthenticated admin access and RCE (CVE-2026-61500) under active exploitation

> Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and leaks outputs of the same generator to unauthenticated clients, letting a remote attacker recover the PRNG state, forge an administrator session cookie and execute code via the server_code feature. VulnCheck canaries observed exploitation attempts from a China-based IP against real vulnerable hosts in the US and Japan, followed by activity from two US-based IPs in the same /24.

- **Published:** 2026-10-03T00:00:00Z
- **Last reviewed:** 2026-10-12T15:54:08.336Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2865
- **ID:** TL-2026-2865
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-61500, CVE-2026-61501

## Description

CVE-2026-61500 affects the TypeScript rewrite of Rejetto HTTP File Server (HFS), versions 3.0.0 through 3.2.0. HFS generates the key used to sign session cookies (via the Koa web framework's keygrip) with JavaScript's Math.random(). V8 implements Math.random() with xorshift128+, a non-cryptographic generator whose internal state is fully reversible. HFS additionally discloses raw Math.random() outputs to unauthenticated clients during login, so an attacker has the observations needed to reconstruct the generator state.

Per Horizon3.ai's write-up and The Register's summary, the exploit chain is: (1) user enumeration to confirm that an admin account exists; (2) collect roughly 12 consecutive Math.random() outputs from the unauthenticated endpoint that leaks them; (3) use the Z3 SMT solver to recover the xorshift128+ internal state; (4) step the state backwards to reconstruct the signing key generated at server startup; (5) forge a valid administrator session cookie (session IP binding could also be bypassed through forged cookie parameters); (6) abuse built-in administrative functionality, namely the server_code configuration feature that accepts custom JavaScript, to run arbitrary code on the host. No prior authentication is required against an internet-reachable instance.

The flaw was discovered by Zach Hanley of Horizon3.ai working with Anthropic's Mythos model (Project Glasswing). It is tracked as CWE-338. The CVE record was published by VulnCheck on 2026-07-13, coinciding with HFS 3.2.1, whose release notes state that multiple security vulnerabilities in all previous versions could allow an attacker to gain administrative access. Horizon3's technical disclosure followed in late September 2026. CVSS is 9.8 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per OpenCVE, and 9.3 (CVSS 4.0) as assigned by the CNA, VulnCheck. Sources report different scores for the same flaw.

According to The Register, VulnCheck's Patrick Garrity said VulnCheck began detecting exploitation of CVE-2026-61500 on the evening of the story, and that canaries saw an actor in China targeting real vulnerable hosts in the US. Targeting of hosts in the US and Japan was reported. Two US-based IPs, 173.239.211.248 and 173.239.211.249 in the same subnet, were reported as follow-on attackers and are suspected to be proxies. The reporting calls the activity China-nexus without naming a group, and notes it is consistent with the documented use of compromised devices as routing proxies in an April 2026 multi-country advisory. The CVE is listed in VulnCheck's KEV database. CraftedSignal's brief records it as not on CISA KEV. The Register cites Patrick Garrity's tracker as showing it is only the second Mythos/Project Glasswing-credited CVE exploited in the wild, out of 286 tracked.

BeaconBeagle returned no record (HTTP 404) for either reported IP at time of research, so no C2 correlation is available.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1087 Account Discovery
- T1606.001 Web Cookies
- T1550.004 Web Session Cookie
- T1059.007 JavaScript
- T1090 Proxy
- T1078 Valid Accounts
- T1595.002 Active Scanning
- T1212 Exploitation for Credential Access
- T1059.003 Command and Scripting Interpreter
- T1059.001 Command and Scripting Interpreter
- T1105 Ingress Tool Transfer

## Sources

- [The Register: Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows](https://www.theregister.com/security/2026/10/03/anthropics-super-bug-hunting-model-mythos-is-hardcore-good-at-math-as-latest-vuln-under-attack-shows/5300933)
- [Horizon3.ai disclosure: Anthropic Mythos Rejetto HFS RCE](https://horizon3.ai/attack-research/disclosures/anthropic-mythos-rejetto-hfs-rce/)
- [VulnCheck advisory: Rejetto HFS session forgery via predictable signing key](https://www.vulncheck.com/advisories/rejetto-hfs-session-forgery-via-predictable-signing-key)
- [Rejetto HFS v3.2.1 release notes](https://github.com/rejetto/hfs/releases/tag/v3.2.1)
- [NVD: CVE-2026-61500](https://nvd.nist.gov/vuln/detail/CVE-2026-61500)
- [OpenCVE: CVE-2026-61500](https://app.opencve.io/cve/CVE-2026-61500)
- [Halo Security CVE advisory: Rejetto HFS predictable session key allows RCE](https://cve.halosecurity.com/cve-advisory/cve-2026-61500-rejetto-hfs-predictable-session-key-allows-rce)
- [CraftedSignal brief: Rejetto HFS session key](https://feed.craftedsignal.io/briefs/2026-07-rejetto-hfs-session-key/)
- [Patrick Garrity: Anthropic-Credited CVEs tracker](https://github.com/patrickmgarrity/Anthropic-Credited-CVEs)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2865