Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-85181: CAT 3.1.0 lets attackers create fake admin sessions
CVE-2026-85181 · published today
Summary
The CAT web tool (up to version 3.1.0) checks session cookies with an insecure method that can be copied and altered without a secret key. Because of this, someone could craft a valid cookie and, by spoofing their IP address, gain full admin access to the system. Update the software or apply a patch that adds proper server‑side validation for session cookies.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dianping | cat | <= 3.1.0 |
Original advisory text
CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
References
- https://github.com/dianping/cat/issues/2384 issue-tracking
- https://github.com/dianping/cat product
- https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/c... technical-description
- https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/c... technical-description
- https://www.vulncheck.com/advisories/cat-through-3.1.0-session-cookie-forgery-vi... third-party-advisory
Severity
9.3
Critical
CVSS 3.1: 9.8 (MITRE)
Type
CWE-565Reliance on Cookies without Validation and Integrity Checking
Timeline
Published3 Sep 2026
Updated3 Sep 2026
First seen3 Sep 2026
Monitor software like this
Free during beta