The vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 arises from using the non-cryptographic Math.random() function to generate session-cookie signing keys. Additionally, outputs from this generator are disclosed to unauthenticated clients during login. An attacker can collect a limited number of login responses to reconstruct the internal state of the PRNG, recover the signing key, and forge administrator session cookies. This enables full administrative access and remote code execution through the server_code configuration feature. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a remote attacker with no privileges or user interaction to gain full administrative access to the affected Rejetto HFS server. This includes the ability to forge valid administrator session cookies and execute arbitrary code remotely via the server_code configuration feature, compromising confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected HFS versions and monitor for suspicious login activity. Consider disabling or restricting the server_code configuration feature if possible to reduce risk.