CVE-2026-61500: Rejetto HFS Session Forgery Vulnerability (found via Anthropic Mythos)

What it is

CVE-2026-61500, a session-forgery vulnerability in Rejetto HTTP File Server (HFS) 3.x, found by Horizon3.ai using Anthropic's Mythos model under Project Glasswing. The existing summary covers the core mechanism; this adds the exploit chain's missing precondition, the exact code locations, and Horizon3's framing of why this matters for the agentic-AI security research shift.

How it works

Koa's keygrip session signer is keyed with randomId(30) (cross.ts:334-341), built from Math.random().toString(36), when COOKIE_SIGN_KEYS is unset (index.ts:41-42) — which it always is, since nothing in the codebase sets it. randomId(30) consumes exactly 3 consecutive Math.random() outputs at process start. Separately, api.auth.ts:78-81's loginSrp1 endpoint stores a full-precision sid = Math.random() in the session, and since koa-session cookies are base64(JSON) signed but not encrypted, any user who can log in (no password required for this step) can read the raw 52-bit double directly from their own cookie. A grep-confirmed fact: these are the only two server-side consumers of Math.random() in the process, which bounds the search space. Mythos's verifying agent chained these two facts, modeled xorshift128+ as invertible over GF(2) in Z3, and recovered the process-start key from the leaked outputs — verifying candidates against the HMAC of the attacker's own legitimately-issued cookie as a free oracle.

Preconditions / Affected

Rejetto HFS 3.x (TypeScript rewrite; the 2.x Delphi version had an unrelated KEV-listed RCE, CVE-2024-23692). Requires a login-enabled username to reach the leaking endpoint (no password needed), and a way to confirm the admin account exists — Mythos separately found a user-enumeration vulnerability (disclosed separately) to supply this. Default config: admin_net is unset, imposing no network restriction on admin access once a cookie is forged.

What to do (exploit chain as disclosed)

1. Enumerate to confirm the built-in admin user exists.
2. Call the unauthenticated/login-adjacent leak endpoint ~12 times to sample raw Math.random() outputs.
3. Feed outputs to Z3 to recover xorshift128+ internal state, step backwards to the process-start signing key.
4. Forge a session cookie: {username:'admin', ts:now, allow_session_ip_change:true} — this also satisfies prepareState, invalidateSessionBefore (empty by default), and IP-binding checks.
5. Use HFS's built-in admin JavaScript-execution feature for RCE.

No patch, version fix, or configuration mitigation is mentioned in the piece.

Caveats

This is a vendor disclosure emphasizing AI-discovery capability as much as the bug itself; Horizon3 states Mythos produced the chain and working PoC "without additional prompting," a claim the post makes but doesn't independently substantiate for the reader. No CVSS score, patched version, or remediation guidance appears in the text.