Rejetto HFS versions 3.0.0 through 3.2.0 contain a critical vulnerability allowing unauthenticated attackers to forge administrator sessions. This exploit enables arbitrary code execution on the server. The root cause lies in the use of JavaScript's Math.random() for security-sensitive operations. Specifically, it was used for the cookie-signing key and a login-handshake identifier, both of which are cryptographically weak.Math.random() in V8 is a deterministic xorshift128+ algorithm. By observing multiple outputs of Math.random() from login handshake identifiers, an attacker can reverse-engineer the PRNG's internal state. This allows them to predict all past and future outputs. With the PRNG state known, the attacker can then recover the cookie-signing key generated at server startup.Once the signing key is obtained, the attacker can forge an administrator session cookie. This forged cookie grants access to administrative functions, including the server_code configuration. By setting a malicious server_code snippet, the attacker achieves remote code execution with root privileges. The entire attack chain is a black-box reconstruction of the server's internal state through HTTP interactions.The vulnerability was discovered by Zach Hanley at Horizon3.ai and exploitation began shortly after. The fix involves replacing the insecure Math.random() with cryptographically secure primitives from Node's crypto module. This includes using randomBytes for the cookie-signing key and randomUUID for session identifiers. The lesson highlights that any security-critical value, even seemingly ephemeral ones, requires a cryptographically secure pseudo-random number generator.