CVE-2026-13576None▾ SunlitCallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give eq…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.
Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.
An attacker who obtains the user table can recover passwords by fast offline guessing.
CallBackery < 0.62.0Upgrade to CallBackery 0.62.0 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118991NoneCallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
CVE-2026-118992High· 8.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
CVE-2026-118987NoneCallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
CVE-2026-118990NoneCallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup
CVE-2026-118986NoneCallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
CVE-2026-118996NoneCallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig