{"id":"CVE-2026-118986","kind":"vulnerability","aliases":["CVE-2026-118986"],"related":[],"title":"CallBackery for Perl: session cookie signing secret can be brute-forced","description":"CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().\n\nThe secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.\n\nAn attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.","summary":"CallBackery versions before 0.62.0 sign session cookies with a secret built from Perl's rand(), which is seeded with only 32 bits. An attacker who holds one session cookie can test all candidate secrets offline and then forge cookies for any user, including an administrator.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["callbackery","package","perl","self-hosted"],"not_affected_if":["custom-strong-secret","version-0.62.0-or-later"],"how_to_check":"- Check the installed CallBackery version; anything below `0.62.0` is affected.\n- Look for the Perl package in your dependency files or installed modules.","fix":"- CallBackery for Perl: `0.62.0`","status":"open","published_at":"2026-10-30T14:16:41+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","triaged_at":"2026-10-30T14:33:07+00:00","updated_at":"2026-10-30T14:33:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T14:33:07Z","model":"claude-haiku-5-5","output":{"fix":"- CallBackery for Perl: `0.62.0`","reach":"internet","title":"CallBackery for Perl: session cookie signing secret can be brute-forced","impact":"high","summary":"CallBackery versions before 0.62.0 sign session cookies with a secret built from Perl's rand(), which is seeded with only 32 bits. An attacker who holds one session cookie can test all candidate secrets offline and then forge cookies for any user, including an administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["perl","callbackery","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker forges admin session cookies and takes over the application","analyst_note":"Confirm from the advisory whether the default install generates the secret with rand() and whether custom secrets avoid the flaw.","how_to_check":"- Check the installed CallBackery version; anything below `0.62.0` is affected.\n- Look for the Perl package in your dependency files or installed modules.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.62.0-or-later","custom-strong-secret"],"who_is_affected":"Any team running CallBackery for Perl before 0.62.0 with a web interface that uses session cookies. The exposure depends on the secret being generated at install time with rand(); deployments that set their own strong signing secret are not affected by the weak generation, though the sources do not say how the secret is configured by default. Teams not running CallBackery can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4172,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118986':15A,18A '-2026':14A,17A '0.62.0':28B,73C '2':116C '32':45B,108C,117C 'administr':69B,151C 'allow':76C 'attack':48B,132C 'bit':46B,109C 'brute':11A 'brute-forc':10A 'built':35B,94C,101C 'built-in':100C 'call':97C 'callbackeri':1A,19B,25B,70C 'candid':57B,129C 'cooki':5A,31B,53B,63B,78C,92C,123C,138C,145C 'cve':13A,16A 'enough':125C 'forc':12A 'forg':62B 'forgeri':79C 'generat':84C 'hold':50B 'host':24B 'includ':67B,149C 'obtain':134C 'offlin':59B,130C 'one':51B,121C 'packag':20B 'perl':3A,21B,37B,75C 'possibl':118C 'rand':39B,86C,103C 'recov':140C 'secret':7A,34B,58B,83C,88C,111C,142C 'seed':42B,106C 'self':23B 'self-host':22B 'session':4A,30B,52B,77C,91C,137C 'sign':6A,29B,82C,90C,122C,144C 'singl':136C 'test':55B,127C 'therefor':112C 'two':96C 'user':66B,148C 'valu':119C 'version':26B,71C 'via':80C","nicknames":[],"mitigations":[],"who_affected":"Any team running CallBackery for Perl before 0.62.0 with a web interface that uses session cookies. The exposure depends on the secret being generated at install time with rand(); deployments that set their own strong signing secret are not affected by the weak generation, though the sources do not say how the secret is configured by default. Teams not running CallBackery can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:16:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118986","severity":null,"published_at":"2026-10-30T14:16:41+00:00","modified_at":"2026-10-30T14:16:41+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","fetched_at":"2026-10-30T14:30:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}