← Vulnerability feed

Vulnerability record · CVE-2026-85181 · published 3 September 2026

CVE-2026-85181: Reliance on cookies without validation vulnerability

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

9.3 CVSS 4.0 Critical EPSS 0.71% · top 48.6% CWE-565 · Reliance on cookies without validation Deferred
9.3CVSS 4.0 base score
0.71%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
5References
23 Sep 2026Last modified by NVD

Description

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://github.com/dianping/cat
https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/system/page/login/service/TokenBuilde
https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/util/HttpUtils.java
https://github.com/dianping/cat/issues/2384
https://www.vulncheck.com/advisories/cat-through-3.1.0-session-cookie-forgery-via-unkeyed-hashcode-checksum

Track CVE-2026-85181 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2026-0257PAN-OS GlobalProtect authentication bypass via unvalidated cookiesPAN-OS GlobalProtect portal and gateway contain authentication bypass flaws that let an attacker skip security restrictions and establish an unauthor…KEVEPSS 96%analysed

Source: NIST National Vulnerability Database (record CVE-2026-85181), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.