CVE-2026-118986None▾ SunlitCallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().
The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.
An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.
CallBackery < 0.62.0Upgrade to CallBackery 0.62.0 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118992High· 8.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
CVE-2026-118987NoneCallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
CVE-2026-118990NoneCallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup
CVE-2026-118991NoneCallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
CVE-2026-118996NoneCallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig
CVE-2026-118994NoneCallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name