Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck
CVE-2026-85181CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
Critical 9.8
In plain English
A critical-severity security flaw in cat from dianping. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.7%top 46.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
Affected products (as reported)
Weakness: CWE-565 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Issue #2384 issue-tracking
- https://github.com/dianping/cat product
- TokenBuilder.java at 3.1.0 technical-description
- HttpUtils.java at 3.1.0 technical-description
- VulnCheck Advisory: CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum third-party-advisory