Live › vulnerability › CVE-2026-118986
CallBackery versions before 0.62.0 sign session cookies with a secret built from Perl's rand(), which is seeded with only 32 bits. An attacker who holds one session cookie can test all candidate secrets offline and then forge cookies for any user, including an administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Any team running CallBackery for Perl before 0.62.0 with a web interface that uses session cookies. The exposure depends on the secret being generated at install time with rand(); deployments that set their own strong signing secret are not affected by the weak generation, though the sources do not say how the secret is configured by default. Teams not running CallBackery can skip it.
No product ranges from the sources yet.
0.62.0 is affected.0.62.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().
The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.
An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-118986")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.