CVE-2026-118986: CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()

Published Oct 30, 2026

Updated

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().

The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 232 possible values, and one signed cookie is enough to test each candidate offline.

An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CallBackery to a version that resolves this vulnerability.
Fixed in 0.62.0

Event History

Oct 30, 2026

CVE Published

via MITRE·01:13 PM

Data Sourced

via MITRE·01:13 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to obtain one signed session cookie. They can then test secret candidates offline, recover the signing secret, and create session cookies for arbitrary users, including administrators.

Which deployments are affected?

CallBackery for Perl versions before 0.62.0 are affected. The issue is in generation of the session-cookie signing secret, which uses two calls to rand() and therefore has at most 2**32 possible secret values.

How can I determine whether my deployment is vulnerable?

Check the installed CallBackery version. Versions earlier than 0.62.0 are vulnerable; version 0.62.0 is the referenced fixed release.

CVE-2026-118986: CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are affected?

How can I determine whether my deployment is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are affected?

How can I determine whether my deployment is vulnerable?