Live › vulnerability › CVE-2026-118987
CallBackery for Perl ignores the 300-second age limit on session cookies sent in the X-Session-Cookie header, while the xsc query parameter is still checked. A session cookie that leaks through logs, a Referer header or browser history can authenticate as its user indefinitely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Teams running CallBackery for Perl with session-based login, where session cookies can end up in logs, Referer headers or browser history. Deployments without session authentication, or those already on 0.62.0 or later, are not exposed.
No product ranges from the sources yet.
0.62.0.X-Session-Cookie header in front-end proxy or application logs.0.62.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header.
cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is.
A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.
This page as .md · .json · in your agent: get_signal("CVE-2026-118987")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.