Live › vulnerability › CVE-2026-13576
CallBackery, a Perl web application, hashes user passwords with unkeyed HMAC-SHA1 and no salt. An attacker who gets the user table can guess passwords offline quickly and recover them, and equal passwords produce equal hashes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Teams running CallBackery versions before 0.62.0 that store user accounts with passwords in its database. Exposure depends on someone obtaining the user table, for example through a database leak or backup exposure. Deployments that do not use CallBackery's local user passwords can skip it.
No product ranges from the sources yet.
0.62.0 are affected.hmac_sha1_sum in the password-hashing code of the installed copy.0.62.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.
Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.
An attacker who obtains the user table can recover passwords by fast offline guessing.
This page as .md · .json · in your agent: get_signal("CVE-2026-13576")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.