CVE-2026-61500: Anthropic Mythos recovered the Rejetto HFS session key and achieved RCE

Horizon3 researcher Zach Hanley used Anthropic's Mythos AI model to discover CVE-2026-61500 in Rejetto HTTP File Server (HFS) 3.x. The vulnerability allows an unauthenticated attacker to forge an administrator session cookie and achieve remote code execution (RCE) without knowing the administrator's password.

When COOKIE_SIGN_KEYS is not explicitly configured, HFS generates a session-cookie signing key using randomId(30), which relies on Math.random(). In the Node.js/V8 environment examined, the generator uses xorshift128+, a predictable pseudorandom number generator unsuitable for cryptographic secrets. A second flaw exists in the loginSrp1 authentication handler, which stores a Math.random() output in ctx.session.loggingIn. Because the session cookie contains signed but unencrypted data, an unauthenticated client can recover the leaked PRNG output.

The demonstrated attack begins by confirming that the built-in admin account exists using a user-enumeration oracle, another issue identified by Mythos. The attacker then initiates 12 unauthenticated login requests and extracts the leaked Math.random() outputs from the returned cookies. Using the Z3 SMT solver, Mythos reconstructs the internal state of xorshift128+ and reverses its state transitions to recover the signing key generated when HFS started. The attacker can then forge a valid session cookie containing username: "admin". Once authenticated as an administrator, the attacker abuses HFS's built-in server_code functionality, which permits server-side JavaScript execution, to run arbitrary code on the server.

The demonstrated chain requires an HFS installation using an automatically generated session-signing key rather than an explicitly configured COOKIE_SIGN_KEYS value. The authentication endpoint must be reachable, and the targeted administrator account must exist. The vulnerability affects Rejetto HFS 3.0.0 through 3.2.0 and was fixed in version 3.2.1.

What Role Did the AI Agent Play? Mythos independently connected two weaknesses: the generation of a sensitive signing key using a predictable PRNG and the disclosure of that generator's outputs through a separate authentication code path. The model developed the Z3 constraints, reconstructed the generator state, recovered the signing key, and produced a working exploit demonstrating administrative session forgery and command execution. According to Horizon3, the researchers did not need to provide additional prompts directing Mythos to find the PRNG leak or investigate mathematical methods for recovering the generator state.

Article: https://horizon3.ai/attack-research/disclosures/anthropic-mythos-rejetto-hfs-rce/