CVE-2026-85181
Received Received - Intake

CAT Session Cookie Integrity Bypass via Java String.hashCode

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85181
EUVD
EUVD-2026-70485

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
meituan_dianping cat 3.1.0
meituan_dianping cat to 3.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-565 The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves CAT using Java String.hashCode as the only integrity check for session cookies without server-side keying. Attackers can forge valid checksums offline, bypass IP binding validation by setting the x-forwarded-for header, and create admin sessions with full configuration access.

Impact Analysis

Attackers can impersonate legitimate users, gain unauthorized admin access, and manipulate system configurations. This could lead to data breaches, unauthorized data access, or system compromise without detection.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for secure session management, data integrity, and access control. It could result in non-compliance, legal penalties, and loss of trust due to unauthorized access and data exposure risks.

Mitigation Strategies

Replace Java String.hashCode with a cryptographically secure server-side keyed integrity check for session cookies. Ensure session validation includes server-side checks beyond client-provided data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85181. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart