CVE-2026-85181: Reliance on Cookies without Validation and Integrity Checking in dianping cat

The vulnerability in dianping cat involves the use of Java String.hashCode as the only integrity check for session cookies, lacking server-side keying. This weak integrity mechanism permits attackers to forge valid session cookies offline. Furthermore, the application validates sessions by IP binding, but this can be bypassed by setting the x-forwarded-for header, allowing attackers to escalate privileges and create admin sessions with full configuration access. The affected versions are from 0 up to and including 3.1.0. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to forge session cookies and bypass IP binding validation, resulting in unauthorized creation of admin sessions with full configuration access. This compromises the confidentiality, integrity, and availability of the affected system.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the application and monitor for suspicious activity related to session manipulation.