CriticalBreachCVE-2026-61500
Anthropic Mythos AI Finds Rejetto HFS Flaw That Lets Attackers Forge Admin Sessions and Execute Code
Cyber Security News·Source published ·1 min read
What happened?
Anthropic’s Mythos AI has identified a critical vulnerability in Rejetto HTTP File Server that could allow remote attackers to forge administrator sessions and execute arbitrary code. The issue, tracked as CVE-2026-61500, stems from predictable session-signing keys generated through JavaScript’s non-cryptographic Math.random() function. Horizon3 made the finding after joining Anthropic’s Project Glasswing in July 2026, which uses the Mythos Preview model and industry partners to identify and fix critical and open-source software flaws.
Key details
- Anthropic Mythos AI discovered a critical flaw in Rejetto HFS 3.x allowing admin session forgery and remote code execution.
- The vulnerability stems from predictable session-signing keys generated via JavaScript's non-cryptographic Math.random() function.
- HFS leaks high-precision random values through the loginSrp1 endpoint cookie, enabling reconstruction of the V8 xorshift128+ PRNG state.
- Attackers can use a Z3 solver to recover the PRNG state, derive the session-signing key, and forge a valid admin session cookie.
- Forged admin cookies can bypass IP restrictions and enable arbitrary JavaScript execution via HFS administrative APIs.
- Mythos autonomously identified the weak PRNG, connected it to exposed values, developed a mathematical recovery approach, and demonstrated command execution.
Fixes and mitigations
- Update to the vendor-fixed release when available.
- Restrict public access to administrative functions.
- Monitor logs for unusual authentication activity or unexpected custom endpoint creation.
What to look for
- Unusual authentication activity in server logs.
- Unexpected custom endpoint creation in HFS administrative interface.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.