Rejetto HFS flaw allows admin takeover via weak random numbers

Active exploitation attempts have been detected against a critical vulnerability in Rejetto HTTP File Server (HFS), a popular self-hosted file sharing tool. Security firm VulnCheck reported that threat actors are targeting the flaw, identified as CVE-2026-61500, which allows remote attackers to seize administrative control and execute arbitrary code on vulnerable systems.

What happened

The vulnerability affects Rejetto HFS versions 3.0.0 through 3.2.0. It carries a CVSS score of 9.3, indicating a critical severity level. The core issue lies in how the application generates session-cookie signing keys. Instead of using a cryptographically secure method, the software relies on JavaScript’s standard Math.random() function. This non-cryptographic pseudo-random number generator (PRNG) produces predictable outputs that can be reverse-engineered by an attacker.

During the login process, the server discloses outputs from this same PRNG to unauthenticated clients. By collecting a small number of these login responses, an attacker can reconstruct the internal state of the generator. Once the state is known, they can predict the session-cookie signing key. With this key, the attacker forges a valid administrator session cookie, bypassing authentication entirely. This grants full administrative access to the server.

The danger escalates because the administrative API in Rejetto HFS includes a feature called server_code. This feature allows administrators to define custom endpoints that execute arbitrary JavaScript on the server. Consequently, once an attacker gains admin privileges through the forged session, they can use this feature to achieve remote code execution (RCE). This creates a direct path from unauthenticated network access to complete system compromise.

A patch for this vulnerability was released in July 2026 with version 3.2.1. However, public awareness and exploit availability lagged behind the fix. In late September 2026, security researcher Alejandro Ramos (known as aramosf) published a Python-based proof-of-concept (PoC) exploit. Shortly after, on September 30, 2026, Horizon3.ai researcher Zach Hanley published details noting that Anthropic’s Mythos model helped discover the flaw. Exploitation attempts were first detected by VulnCheck on October 1, 2026, targeting hosts in the United States and Japan.

How it works

The mechanism relies on the deterministic nature of standard PRNGs like Math.random(). While these generators appear random for general programming tasks, they are not designed for security. They operate based on an initial seed value and a mathematical algorithm. If an observer can see enough outputs from the generator, they can deduce the current state of the algorithm.

In Rejetto HFS, the server uses this weak generator to create the secret key that signs session cookies. Crucially, the server also leaks outputs from the same generator instance during the Secure Remote Password (SRP) login handshake. An attacker does not need to guess the key directly. Instead, they capture the leaked PRNG outputs from a legitimate login attempt. Using these samples, they reconstruct the PRNG’s internal state. From there, they can predict every future output, including the specific value used to sign the admin session cookie. This allows them to craft a cookie that the server accepts as valid, granting them admin rights without knowing any passwords.

Key details

• Vulnerability ID: CVE-2026-61500 with a CVSS score of 9.3.
• Affected Versions: Rejetto HFS 3.0.0 through 3.2.0.
• Root Cause: Use of non-cryptographic Math.random() for session-key generation and leakage of PRNG state during login.
• Impact: Session forgery leading to full administrative access and remote code execution via the server_code feature.
• Patch Status: Fixed in version 3.2.1, released in July 2026.
• Exploit Availability: Public Python-based PoC released in late September 2026 by Alejandro Ramos.

Why it matters

For developers and IT leads managing self-hosted infrastructure, this incident highlights a common but dangerous pitfall: using standard library functions for security-critical operations. Math.random() is ubiquitous in JavaScript development for tasks like generating UI elements or game mechanics. However, its predictability makes it fatal for cryptography. This case serves as a stark reminder that security boundaries must be drawn carefully, especially in applications that expose administrative interfaces to the network.

The delay between the patch release in July and the active exploitation in October illustrates the risk of "silent fixes." Many organizations may have updated their software if they followed vendor changelogs closely, but others likely remained vulnerable because the severity was not widely publicized until the PoC emerged. The involvement of AI models in discovering the flaw also suggests that automated auditing tools are becoming more sophisticated, potentially finding similar weak PRNG usage in other open-source projects.

Furthermore, this is the second major exploited vulnerability in Rejetto HFS recently. In July 2024, CVE-2024-23692 was weaponized to deliver malware like HATVIBE and cryptocurrency miners. The recurrence of active exploitation against this software indicates it is a high-value target for threat actors. Teams running HFS must treat it as a high-risk component and ensure strict isolation or immediate patching.

What you can do

• Upgrade immediately: If you run Rejetto HFS, update to version 3.2.1 or later. This version replaces the weak PRNG with a secure alternative.
• Audit dependencies: Check other JavaScript-based services for uses of Math.random() in security contexts, such as token generation or session signing. Replace them with crypto.getRandomValues() or equivalent secure APIs.
• Restrict network access: Limit exposure of the HFS administrative interface. Use firewalls or reverse proxies to allow access only from trusted IP addresses or internal networks.
• Monitor logs: Look for unusual login patterns or failed authentication attempts from unknown IPs. VulnCheck noted reconnaissance activity from specific China Telecom IPs; monitor for similar anomalies.
• Disable server_code: If your workflow does not require custom JavaScript endpoints, disable the server_code configuration feature to reduce the impact of potential admin account compromises.
• Review past incidents: Since CVE-2024-23692 was also actively exploited, verify that your systems were patched for that earlier flaw to prevent compound vulnerabilities.