AI Model Forged Session Cookies to Break Rejetto HFS

An AI model found a remote code-execution flaw in the open-source Rejetto HTTP File Server — not by brute force, but by noticing that the software was trusting its own randomness. The discovery, made by Horizon3.ai using Anthropic's Mythos model, traces a single insecure number generator through a chain of decisions all the way to a forged administrator session. The result is CVE-2026-61500, rated 9.3, and it is now being actively exploited in the wild.

A vulnerability with no obvious flaw

Rejetto HFS is a lightweight tool for sharing files over the web. The flaw affects versions 3.0.0 through 3.2.0; version 3.2.1 contains the fix. An unauthenticated attacker who can query the login flow repeatedly can collect enough generator output to reconstruct the signing key and mint a valid administrator session.

What makes it interesting is how much of the chain is correct-by-default and wrong-by-coincidence. Each step in the code is defensible on its own. The failure is that they all feed the same underlying source of randomness, and that source can be read back through the network.

The mechanism: one PRNG, two keys, one leak

The whole exploit hangs on JavaScript's Math.random(), which in Chromium and Node is backed by a xorshift128+ generator. The generator is fast, but it is not a cryptographic source — and, crucially, it is invertible. Given enough consecutive outputs, an attacker can work backward to the generator's internal state and predict every value it will produce thereafter.

HFS reaches for Math.random() in two places that each matter independently:

• it builds randomId(30) strings from Math.random().toString(36), producing identifiers used across the app;
• when the operator has not set a dedicated secret, it derives the Koa keygrip session-signing key from one of those same random IDs.

So when COOKIE_SIGN_KEYS is left unset — the default — the key that signs every session cookie is drawn from the same stream. Koa then signs all session cookies with that key. The problem: the session itself also seeds a value with Math.random() and stores it, and the base64 JSON it exposes in cookies lets a remote client observe enough of the PRNG's output to reconstruct the generator's state. Reconstruct the state, and you have the signing key. With the signing key, you can forge a fully valid admin session cookie and walk through the front door.

Tenacity is the final ingredient, because server_code — a configuration feature that lets an administrator's session execute arbitrary JavaScript — is the actual code-execution sink. A forged admin session is not enough on its own; it has to be a session that can run code. It is, because it is indistinguishable from a real one.

How an AI found the leak path

Horizon3.ai reports that Mythos was run through a multi-agent harness aimed at cryptographic and design weaknesses. It connected two separate facts: the signing key came from a non-cryptographic PRNG, and unauthenticated login responses exposed other outputs from the same stream. That link turns a weak generator into a remotely exploitable authentication bypass.

The result was a proof of concept: watch the session, reconstruct the state, recover the key, forge the admin cookie, execute code. The Rejetto HFS v3.2.1 release (July 13, 2026) carries the fix; every prior build is affected.

Why it matters

On October 2, VulnCheck reported small-scale reconnaissance and exploitation attempts from a China Telecom address hitting canaries in Japan and the United States. That is evidence of hostile activity, but it does not by itself establish a broad campaign or attribute the operator.

The deeper lesson is about a failure mode that AI accelerates: vulnerabilities that have no single obvious bug, only a web of individually-reasonable choices that combine into a hole. Finding those chains requires reading a codebase the way a domain expert would, then connecting the incoherent dots. That is exactly the reasoning an advanced model is good at now. Security teams should assume the bar for "defensible-by-default" code is going up — the things that survive review will increasingly be the things that survive an AI that reads the room.