---
id: "CVE-2026-107243"
page: "https://infrastack.ai/live/CVE-2026-107243"
kind: "vulnerability"
aliases: ["CVE-2026-107243"]
title: "Versa VOS: hardcoded session secret lets attackers forge login cookies"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "sd-wan", "self-hosted", "versa-flexvnf", "versa-vos"]
not_affected_if: ["provisioning-complete", "service-disabled"]
published_at: "2026-11-10T01:17:12+00:00"
first_seen_at: "2026-11-10T01:26:36+00:00"
updated_at: "2026-11-10T01:36:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107243", "first_seen_at": "2026-11-10T01:26:36+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107243", "first_seen_at": "2026-11-10T01:36:58+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-107243"]}]
exploit_sources: []
---

# Versa VOS: hardcoded session secret lets attackers forge login cookies

Link for people: https://infrastack.ai/live/CVE-2026-107243 (this .md is for agents)

The Node.js provisioning web service on Versa VOS (formerly FlexVNF) signs session cookies with a hardcoded secret shared by every VOS appliance. An attacker who obtains a valid session ID can forge a cookie that any VOS appliance in the deployment accepts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Node.js web service used for URL-based zero touch provisioning is still enabled on each VOS appliance; per the CVE text, devices where it is disabled are not exploitable.
- Affected and fixed VOS versions are not published in any source I could reach (Versa's PSIRT advisory on the Versa Security Portal was not retrievable): unknown. Check the Versa Security Portal for CVE-2026-107243.

## Timeline

- 2026-11-10T01:26:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107243
- 2026-11-10T01:36:58+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-107243 — Versa PSIRT advisory not reachable (portal returned no content); only the NVD/CNA text found. No versions or fix known, no exploitation reported, no PoC. Nothing verified. Sibling CVEs 107240/107242/107244 are the same Node.js ZTP service. X not searched.

## Documents

- [describes] NVD: CVE-2026-107243 https://nvd.nist.gov/vuln/detail/CVE-2026-107243

## From the sources

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment. 

Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_