{"id":"CVE-2026-13576","title":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes","summary":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give eq…","severity":"none","cwe":["CWE-916","CWE-759"],"product":"CallBackery","affected":["CallBackery < 0.62.0"],"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T13:09:47.702Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-13576","references":[{"url":"https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes"}],"tags":["cve.org"],"epss":0.00104,"epssPercentile":0.01041,"ingestedAt":"2026-11-05T16:07:30.229Z","slug":"CVE-2026-13576","body":"## Overview\n\nCallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.\n\nAn attacker who obtains the user table can recover passwords by fast offline guessing.\n\n## Affected\n\n- `CallBackery < 0.62.0`\n\n## Remediation\n\nUpgrade to CallBackery 0.62.0 or later.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}