CVE-2026-85181

CriticalCVSS 9.8/10Last modified Sep 23, 2026

Description

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-565

Affected software

No affected versions have been published.

Timeline

Published
Sep 3, 2026
Last modified
Sep 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-851827.5vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated aCVE-2026-851839.3Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialedCVE-2026-851849.1@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, CVE-2026-851859.6Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allCVE-2026-851866.3A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateiCVE-2026-851877.3A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function OrderCVE-2026-851886.9Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, PrCVE-2026-851897.5Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treatCVE-2026-85198.8Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory wCVE-2026-851907.5Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index insertCVE-2026-851917.5Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & CVE-2026-851929.4Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0 - C