CVE Feed

    Dashboard / CVE / CVE-2026-118986

    CVE-2026-118986

    CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline. An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.

    Published:Oct 30, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 30, 2026
    EPSS Score:
    CVSS Score:

    Affected Products

    Vendor
    Perl
    Product
    Callbackery

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-118987 — CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie hea…
    CVE-2026-118990 — CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp …
    CVE-2026-118991 — CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES …
    CVE-2026-118992 (CVSS 8.4) — CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restore…
    CVE-2026-118993 — CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a reg…
    CVE-2026-118994 — CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() write…
    CVE-2026-118995 — CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidat…
    CVE-2026-118996 — CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note vi…
    CVE-2026-13576 — CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are …
    CVE-2026-118988 — CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path trav…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High