---
id: CVE-2026-85181
title: >-
  CAT uses Java String.hashCode as the sole integrity check for session cookies
  without server-side keying, allowing attackers to forge valid checksums
  offline
summary: >-
  CAT uses Java String.hashCode as the sole integrity check for session cookies
  without server-side keying, allowing attackers to forge valid checksums
  offline. Attackers can set the x-forwarded-for header to bypass IP binding
  validation a…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-565
published: '2026-09-03'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:45.670'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85181'
references:
  - url: 'https://github.com/dianping/cat'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/system/page/login/service/TokenBuilder.java
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dianping/cat/blob/3.1.0/cat-home/src/main/java/com/dianping/cat/util/HttpUtils.java
    label: disclosure@vulncheck.com
  - url: 'https://github.com/dianping/cat/issues/2384'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/cat-through-3.1.0-session-cookie-forgery-via-unkeyed-hashcode-checksum
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00382
epssPercentile: 0.32071
ingestedAt: '2026-09-23T17:28:14.822Z'
---

## Overview

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.