CallBackery before 0.62.0 has password and session flaws
The note describes unsalted HMAC-SHA1 passwords, cookie forgery via rand(), and session cookies accepted at any age.
52
CVE-2026-13576
Unsalted HMAC-SHA1 password storage in CallBackery before 0.62.0
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CallBackery for Perl before 0.62.0 stores user passwords as unsalted HMAC-SHA1 hashes via Mojo::Util hmac_sha1_sum() with no key and no work factor. Identical passwords produce identical hashes, so an attacker who obtains the user table can recover passwords by fast offline guessing. Anyone with access to that table is affected.
What to do: Upgrade CallBackery to 0.62.0 or later so passwords are no longer stored as unsalted HMAC-SHA1 hashes.
| Product | Affected | Fixed in |
|---|---|---|
| CallBackery | before 0.62.0 | 0.62.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing.
- Weakness
- CWE-759, CWE-916
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N