Rejetto HFS 3.0.0-3.2.0 Flaw Lets Attackers Forge Admin Sessions

·6 views

Rejetto HFS, a widely deployed single-executable file server with a browser admin page, has a vulnerability tracked as CVE-2026-61500. Affected versions 3.0.0 through 3.2.0 derive the session cookie signing key from JavaScript's Math.random(), a non-cryptographic generator. Because its outputs are exposed during login, an attacker can reconstruct its internal state and recover the key to forge administrator sessions. Such access can escalate to code execution through the server_code feature, potentially under a local administrator account. Version 3.2.1 contains the fix, and administrators are advised to restrict admin interface exposure, reduce service privileges, and treat pre-upgrade sessions as suspect.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CS graduate joins DEV Community, plans to share Web3 and development learning

A computer science graduate has introduced themselves as a new member of the DEV Community. Their interest in tech began with web development and later extended to Web3, hackathons, and other areas of software engineering. They say they plan to explore new technologies, share their projects and challenges, and connect with other developers. The post also encourages readers to share which technology they are currently excited about.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Logging In With Owners' Passwords Alarms Banks

Developers have commonly handed their own passwords or equivalent keys to AI agents so the agents can access dashboards, cloud consoles, and banking sites. US banks are reportedly detecting unverified agentic activity on customer accounts, and Chase has warned customers against sharing credentials with third-party agents. Banks cannot easily distinguish a legitimate agent using a password from a criminal using stolen credentials, since both produce similar signals. Actions taken by an agent under a shared login are attributed to the account owner, creating accountability and fraud risks. The article recommends giving each agent its own scoped, time-limited identity with auditing and revocation, citing new products from 1Password and IDENTOS as early examples.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SlothSync Uses Gemini to Turn Task Lists into Gentle, Manageable Steps

SlothSync is an open-source Python web app that takes a cluttered list of errands and obligations and converts it into a few small next steps. It also separates out tasks that can safely wait. The backend sends the list to Google's Gemini API using a key stored in a local .env file, while the browser saves drafts and the latest plan in local storage. Because the tasks are processed through a hosted API, the app needs an internet connection and does not run an open-weight model offline, which the challenge brief asked for. The author has not yet measured how much time the tool saves.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Stateless language agents cut token use over 84% in long-horizon research tasks

Long-horizon LLM agents often consume tokens so quickly that billion-step research becomes impractical, because each call replays an ever-growing history of intermediate results. Stateless Language Agents (SLAs) address this by moving durable state into an external harness, so each worker sees only the concise evidence it needs. According to the paper, SLAs match the strongest kernel baseline's final performance while using over 84% fewer tokens, across software engineering, kernel optimization, and algorithm design tasks at budgets up to a billion tokens. The coordinating Advisor component accounts for under 0.6% of token usage. The approach depends on the harness summarizing evidence accurately, and the evaluation covers only three engineered domains, leaving its applicability to less structured research open.

0 comments Read more at DEV Community