CVE-2026-13576: CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes

Published Oct 30, 2026

Updated

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.

Passwords are hashed with hmacsha1sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.

An attacker who obtains the user table can recover passwords by fast offline guessing.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CallBackery for Perl to a version that resolves this vulnerability.
Fixed in 0.62.0

Event History

Oct 30, 2026

CVE Published

via MITRE·01:09 PM

Data Sourced

via MITRE·01:09 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to offline password recovery?

Deployments running CallBackery for Perl before 0.62.0 are exposed if an attacker obtains the user table containing password hashes. The hashes can be guessed offline without further interaction with the application.

What makes these hashes easier to attack than modern password hashes?

Passwords are stored as a single fast HMAC-SHA1 operation with no key, salt, or work factor. Identical passwords produce identical hashes, and attackers can perform high-speed guessing against stolen hashes.

CVE-2026-13576: CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes

Remediation

Event History

Frequently Asked Questions

Who is exposed to offline password recovery?

What makes these hashes easier to attack than modern password hashes?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to offline password recovery?

What makes these hashes easier to attack than modern password hashes?