{"id":"CVE-2026-118987","kind":"vulnerability","aliases":["CVE-2026-118987"],"related":[],"title":"CallBackery Perl: old session cookies accepted indefinitely via X-Session-Cookie header","description":"CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header.\n\ncookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is.\n\nA session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.","summary":"CallBackery for Perl ignores the 300-second age limit on session cookies sent in the X-Session-Cookie header, while the xsc query parameter is still checked. A session cookie that leaks through logs, a Referer header or browser history can authenticate as its user indefinitely.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["callbackery","package","perl","self-hosted"],"not_affected_if":["version-0.62.0-or-later"],"how_to_check":"- Check the installed CallBackery version; affected versions are those before `0.62.0`.\n- Look for use of the `X-Session-Cookie` header in front-end proxy or application logs.","fix":"- Move to CallBackery `0.62.0` or later.","status":"open","published_at":"2026-10-30T14:16:41+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","triaged_at":"2026-10-30T14:33:06+00:00","updated_at":"2026-10-30T14:33:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T14:33:06Z","model":"claude-haiku-5-5","output":{"fix":"- Move to CallBackery `0.62.0` or later.","reach":"network","title":"CallBackery Perl: old session cookies accepted indefinitely via X-Session-Cookie header","impact":"medium","summary":"CallBackery for Perl ignores the 300-second age limit on session cookies sent in the X-Session-Cookie header, while the xsc query parameter is still checked. A session cookie that leaks through logs, a Referer header or browser history can authenticate as its user indefinitely.","audience":"businesses","category":"package","nicknames":[],"who_cares":["callbackery","perl","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"A leaked old session cookie grants indefinite access as its user","analyst_note":"","how_to_check":"- Check the installed CallBackery version; affected versions are those before `0.62.0`.\n- Look for use of the `X-Session-Cookie` header in front-end proxy or application logs.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.62.0-or-later"],"who_is_affected":"Teams running CallBackery for Perl with session-based login, where session cookies can end up in logs, Referer headers or browser history. Deployments without session authentication, or those already on `0.62.0` or later, are not exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":4167,"output_tokens":501,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118987':16A,19A '-2026':15A,18A '0.62.0':76C '300':31B,99C 'accept':6A,79C,122C 'age':33B,84C 'arriv':104C 'authent':68B,141C 'browser':65B,139C 'callbackeri':1A,20B,26B,73C 'check':53B 'cooki':5A,12A,37B,44B,56B,81C,91C,96C,112C,119C,129C 'cookieconf':93C 'cve':14A,17A 'header':13A,45B,63B,92C,120C,137C 'histori':66B,140C 'host':25B 'howev':123C 'ignor':29B 'indefinit':7A,72B,145C 'leak':58B,131C 'limit':34B 'log':60B,134C 'old':3A,124C 'older':97C 'packag':21B 'paramet':50B,109C 'perl':2A,22B,28B,78C 'queri':49B,108C 'refer':62B,136C 'reject':94C 'second':32B,100C 'self':24B 'self-host':23B 'sent':38B,85C,113C 'session':4A,11A,36B,43B,55B,80C,90C,118C,128C 'still':52B 'user':71B,144C 'version':74C 'via':8A 'x':10A,42B,89C,117C 'x-session-cooki':9A,41B,88C,116C 'xsc':48B,107C","nicknames":[],"mitigations":[],"who_affected":"Teams running CallBackery for Perl with session-based login, where session cookies can end up in logs, Referer headers or browser history. Deployments without session authentication, or those already on `0.62.0` or later, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:16:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118987","severity":null,"published_at":"2026-10-30T14:16:41+00:00","modified_at":"2026-10-30T14:16:41+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","fetched_at":"2026-10-30T14:30:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}