CVE-2026-85181 | BDVDB-2026-367807 Detail
dianpingcat
Description#
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-565 Reliance on Cookies without Validation and Integrity Checking
References#
- https://github.com/dianping/cat/issues/2384
- https://github.com/dianping/cat
- https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/system/page/login/service/TokenBuilder.java
- https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/util/HttpUtils.java
- https://www.vulncheck.com/advisories/cat-through-3.1.0-session-cookie-forgery-via-unkeyed-hashcode-checksum
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.