Session Cookie Forgery in VOS by Versa Networks

CVE-2026-107243

What is CVE-2026-107243?

The VOS (previously Versa FlexVNF) utilizes a Node.js web service for URL-based Zero Touch Provisioning, which is not needed post-provisioning. A security issue arises from the express-session middleware in its server.js, which employs a hardcoded secret common to all appliances. This allows attackers to leverage valid session IDs to forge session cookies with an accurate HMAC-SHA256 signature. Such forged cookies can be accepted across any deployed VOS appliance due to the shared secret. To mitigate this vulnerability, it is advised to disable the Node.js web service immediately after provisioning is complete, as outlined in Versa's security hardening guide.

References