CVE-2026-85181: CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can forge session-cookie checksums offline and use the x-forwarded-for header to bypass the IP-binding validation.
What level of access can successful exploitation provide?
Successful exploitation can create administrator sessions with full configuration access.
Are deployments affected by default?
The available data identifies the vulnerable session-cookie integrity design and IP-binding bypass, but does not state whether any particular default deployment configuration enables or disables the affected behavior.
What versions are known to be affected?
CAT through version 3.1.0 is identified as affected. The provided information does not identify a fixed version or workaround.