CAT relies on the Java String.hashCode function as the sole integrity check for session cookies, and the checksum is not keyed. This flaw allows attackers to compute a valid checksum offline and construct a forged cookie that the server accepts as authentic. Once the forged cookie is used, the attacker can gain admin session privileges, which provide full access to the system configuration. The weakness is classified as CWE‑565.

The affected product is Dianping CAT, up to and including version 3.1.0. No other versions or product families are listed explicitly in the CNA data.

The CVSS score of 9.3 indicates a high‑severity vulnerability that can be exploited remotely. EPSS data is not available, and the issue is not in CISA’s KEV catalog. According to the description, an attacker can bypass IP binding validation by setting an X‑Forwarded‑For header and then send a crafted HTTP request to forge a cookie. The exploit path is straightforward and does not require any privileged access other than the ability to send HTTP requests to the application.