CAT Session Cookie Forgery Vulnerability

CAT, a web application framework, uses Java String.hashCode as the sole integrity check for session cookies.

This allows attackers to forge valid checksums offline, creating admin sessions with full configuration access.

Attackers can also bypass IP binding validation by setting the x-forwarded-for header.