CallBackery before 0.62.0 has password and session flaws
The note describes unsalted HMAC-SHA1 passwords, cookie forgery via rand(), and session cookies accepted at any age.
52
CVE-2026-118987
Unbounded session cookie lifetime in CallBackery before 0.62.0
- CVSS 3.1
- 5.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CallBackery for Perl rejects session cookies older than 300 seconds only when they arrive in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted at any age. Anyone who obtains a cookie leaked via a log, a Referer header, or browser history can authenticate as that user indefinitely. Versions before 0.62.0 are affected.
What to do: Upgrade CallBackery to 0.62.0 so cookies in the X-Session-Cookie header are subject to the same age check.
| Product | Affected | Fixed in |
|---|---|---|
| CallBackery for Perl | before 0.62.0 | 0.62.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is. A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N