Cyber ·
CallBackery for Perl before 0.62.0: 10 CVEs affecting passwords and sessions
An oss-sec feed notice reports ten CVEs in CallBackery for Perl versions before 0.62.0, including insecure password storage and forgeable session cookies.
This item is a machine translation of a notice posted to the oss-sec feed on 30 October 2026. The title lists ten CVEs affecting CallBackery for Perl versions before 0.62.0. The available excerpt describes four of them. CVE-2026-13576 states that user passwords are stored as unsalted HMAC-SHA1 hashes. CVE-2026-118986 allows session cookie forgery because the signing secret is generated with rand(). CVE-2026-118987 accepts session cookies of any age sent in the X-Session-Cookie header. The description of CVE-2026-118990 is cut off in the text, so its effect cannot be stated. The other six do not appear in the excerpt and are not described here.
To check the notice, consult the original oss-sec archive through the source address given in the feed and confirm the full CVE list, the affected versions and the fix in each CVE record and in the project changelog. Also verify whether your installation uses this software, which version is active, and whether accounts or sessions need to be renewed after the update.
Original source: CallBackery para Perl anterior à versão 0.62.0 (10 CVEs)