{"uuid": "e87c8da7-1c71-4087-9c5b-d846aa2daae3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61500", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mx7aksgrct2o", "content": "\ud83e\udd16 CVE-2026-61500 (CVSS 9.3): Rejetto HFS 3.0.0\u20133.2.0 signs session cookies with a Math.random()-derived key and leaks its output at login. Recover key \u2192 forge admin cookie \u2192 RCE via server_code. Actively scanned, PoC out. Fixed in 3.2.1.\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-61500", "creation_timestamp": "2026-10-06T10:40:46.674956Z"}