CVE-2026-118987None▾ SunlitCallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sen…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header.
cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is.
A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.
CallBackery < 0.62.0Upgrade to CallBackery 0.62.0 or later and set max_session_age in the BACKEND section.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118992High· 8.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
CVE-2026-118990NoneCallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup
CVE-2026-118986NoneCallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
CVE-2026-118991NoneCallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
CVE-2026-118996NoneCallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig
CVE-2026-118994NoneCallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name