CallBackery before 0.62.0 has password and session flaws
The note describes unsalted HMAC-SHA1 passwords, cookie forgery via rand(), and session cookies accepted at any age.
52
CVE-2026-118986
Session cookie forgery in CallBackery before 0.62.0
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CallBackery for Perl builds the secret that signs session cookies from two calls to Perl's built-in rand(), which is seeded with only 32 bits, so the secret has at most 2**32 values. Anyone who obtains one signed session cookie can test candidates offline, recover the secret, and forge cookies for any user, including an administrator. Versions before 0.62.0 are affected.
What to do: Upgrade CallBackery to 0.62.0.
| Product | Affected | Fixed in |
|---|---|---|
| CallBackery | before 0.62.0 | 0.62.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline. An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.
- Weakness
- CWE-338
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N