CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

CAT (dianping/cat) through version 3.1.0 contains a critical session cookie forgery vulnerability. The application uses Java's String.hashCode() as the sole integrity check for session cookies without any server-side secret keying, allowing attackers to forge valid checksums entirely offline. Additionally, attackers can manipulate the x-forwarded-for header to bypass IP binding validation mechanisms. By combining these two weaknesses, an attacker can craft admin session cookies granting full configuration access to the application. The vulnerability is tracked as CVE-2026-85181 and affects the TokenBuilder and HttpUtils components of the cat-home module. No server-side secret is involved in the checksum calculation, making the forgery trivial for any attacker familiar with Java's deterministic hashCode algorithm.