The flaw in Rejetto HFS stems from using a non‑cryptographic Math.random() generator to create the session‑cookie signing key while also exposing generator outputs to any client that logs in. This permits an attacker to capture a handful of login responses, reconstruct the RNG state, recover the signing key, and forge a valid administrator session cookie. The attacker then gains full administrative privileges and can execute arbitrary code on the server through the server_code configuration feature.

Version 3.0.0 through 3.2.0 of Rejetto HFS are vulnerable. The problem is fixed in release 3.2.1 and later.

The CVSS score of 9.3 indicates a critical vulnerability, and the EPSS score of <1% suggests a very low but nonzero exploitation probability. Because the attacker only needs to interact with the publicly exposed login endpoint and does not require prior authentication, it is inferred that the flaw can be exploited against a publicly reachable instance. The vulnerability is not listed in the CISA KEV catalog, but its remote code execution capability warrants prompt remediation.