CVE-2026-61500

Rejetto HFS signed its session cookies with a key from JavaScript's Math.random, and handed out numbers from the same generator to anyone who started a login. Either alone is survivable. Together they let a stranger forge an admin session and run code. Horizon3 found it with Anthropic's Mythos, published a proof of concept, and scanning began within days.

1 article — 2026-10-06

Authoritative record

Root Notes reports on this identifier; it does not maintain it. For the vendor advisory, the affected versions and the scoring, NVD and MITRE hold the primary records.

Our coverage

A model found the weak random number generator and, in the same pass, the unauthenticated path that leaks its output

2026-10-06Security

../cve — every identifier we have covered