{"id":"CVE-2026-85181","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-85181","summary":"CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum","details":"CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.","published":"2026-09-03T14:12:19.751Z","modified":"2026-09-04T03:48:01.164983276Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85181.json"},{"type":"PACKAGE","url":"https://github.com/dianping/cat"},{"type":"ARTICLE","url":"https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/system/page/login/service/TokenBuilder.java"},{"type":"ARTICLE","url":"https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/util/HttpUtils.java"},{"type":"REPORT","url":"https://github.com/dianping/cat/issues/2384"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85181"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/cat-through-3.1.0-session-cookie-forgery-via-unkeyed-hashcode-checksum"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-04T03:48:01.164983276Z"}}