CallBackery before 0.62.0 has password and session flaws
Original title: CallBackery versions before 0.62.0 for Perl (10 CVEs)
The note describes unsalted HMAC-SHA1 passwords, cookie forgery via rand(), and session cookies accepted at any age.
Robert Rothenberg posted to oss-security on October 30 about CallBackery for Perl before 0.62.0. The visible entries say CVE-2026-13576 covers unsalted HMAC-SHA1 password hashes, CVE-2026-118986 allows session-cookie forgery because the signing secret is generated with rand(), and CVE-2026-118987 accepts session cookies of any age in the X-Session-Cookie header. CVE-2026-118990 is named, but its description is cut off. The title refers to 10 CVEs.
Unconfirmed: The feed snippet is truncated, so only four of the 10 CVEs named in the title are partly described.
- Affected releases are CallBackery for Perl before 0.62.0.
- CVE-2026-13576 concerns unsalted HMAC-SHA1 password storage.
- CVE-2026-118986 concerns a signing secret generated with rand().
- CVE-2026-118987 concerns cookies of any age in X-Session-Cookie.
Impact: Password-hash weakness and session-cookie forgery or acceptance
| Product | Affected | Fixed in |
|---|---|---|
| CallBackery | before 0.62.0 | 0.62.0 |
- 1.Upgrade CallBackery for Perl to 0.62.0 or later.
- Products
- CallBackery
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-118986+2 related CVEs | Session cookie forgery in CallBackery before 0.62.0 | 7.5 group max | — | ||
| CVE-2026-118987 | Unbounded session cookie lifetime in CallBackery before 0.62.0 | 5.3 | — |
From the original article
Posted by Robert Rothenberg on Oct 30 CVE-2026-13576 CallBackery versions before 0. 62. 0 for Perl store user passwords as unsalted HMAC-SHA1 hashes CVE-2026-118986 CallBackery versions before 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.