What’s Vulnerable › Vulnerabilities

CVE-2026-85181: CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-03 · updated 2026-09-23
• Weakness: CWE-565

Description

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

Affected products

• dianping cat: through 3.1.0

References

• https://github.com/dianping/cat
• https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/system/page/login/service/TokenBuilder.java
• https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/util/HttpUtils.java
• https://github.com/dianping/cat/issues/2384
• https://www.vulncheck.com/advisories/cat-through-3.1.0-session-cookie-forgery-via-unkeyed-hashcode-checksum

Get alerted when CVE-2026-85181 or the next vulnerability affects your stack