CVE-2026-118986

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand. The secret that signs session cookies is built from two calls to the built-in rand, which is seeded with 32 bits. The secret therefore has at most 232 possible values, and one signed...

CVE-2026-118987

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is....

CVE-2026-118993

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The beforedispatch hook installed by startup removes PATHINFO from the end of the request URI with a substitution that interpolates PATHINFO...

CVE-2026-118994

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record...

CVE-2026-118995

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator is documented to anchor the supplied pattern at both ends, but builds /^$rx$/ without grouping the pattern. An alternation such as yes|no then accepts any value...

CVE-2026-118996

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators...

CVE-2026-13576

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmacsha1sum from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker w...

CVE-2026-118988

CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search-find...

CVE-2026-118990

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...

CVE-2026-118991

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digi...

CVE-2026-118992

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or...

CVE-2026-118986

CallBackery versions prior to 0.62.0 for Perl are vulnerable to session cookie forgery due to the use of a cryptographically weak pseudo-random number generator (CWE-338 ). The vulnerability stems from the signing secret being generated using two calls to the built-in rand() function, which is se...

EUVD-2026-113922

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand. The secret that signs session cookies is built from two calls to the built-in rand, which is seeded with 32 bits. The secret therefore has at most 232 possible values, and one signed...

CVE-2026-118986 CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand. The secret that signs session cookies is built from two calls to the built-in rand, which is seeded with 32 bits. The secret therefore has at most 232 possible values, and one signed...

CVE-2026-118987

The CallBackery Perl module (versions before 0.62.0 ) is vulnerable to the use of expired session cookies when delivered via the X-Session-Cookie header. While the cookieConf() function correctly rejects cookies older than 300 seconds in the xsc query parameter, it fails to apply this restriction...

EUVD-2026-113921

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is....

CVE-2026-118987 CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is....

CVE-2026-118990

Versions of CallBackery for Perl before 0.62.0 are vulnerable to a configuration database exposure. The getConfigBlob() function triggers the sqlite3 shell to write a dump to /tmp/cbdump, which is not subsequently removed. Because the file follows the process umask and targets a predictable name,...

EUVD-2026-113920

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...

CVE-2026-118990 CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...