---
id: CVE-2026-118987
title: >-
  CallBackery versions before 0.62.0 for Perl accept session cookies of any age
  sent in the X-Session-Cookie header
summary: >-
  CallBackery versions before 0.62.0 for Perl accept session cookies of any age
  sent in the X-Session-Cookie header.


  cookieConf() rejects a cookie older than 300 seconds only when it arrives in
  the xsc query parameter. The same cookie sen…
severity: none
cwe:
  - CWE-1463
product: CallBackery
affected:
  - CallBackery < 0.62.0
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T13:13:11.338Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118987'
references:
  - url: 'https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes'
tags:
  - cve.org
epss: 0.00158
epssPercentile: 0.04962
ingestedAt: '2026-11-05T16:07:30.249Z'
---

## Overview

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header.

cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is.

A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.

## Affected

- `CallBackery < 0.62.0`

## Remediation

Upgrade to CallBackery 0.62.0 or later and set max_session_age in the BACKEND section.