CVE-2026-13576: vulnerability in CallBackery
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.1%
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.
Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.
An attacker who obtains the user table can recover passwords by fast offline guessing.
Affected products
CallBackeryRelated CVEs — CallBackery
In the same product, most dangerous first.
CVE-2026-118995—CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidatorEPSS 0.3%CVE-2026-118988—CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc routeEPSS 0.2%CVE-2026-118992HIGHCallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backupEPSS 0.2%CVE-2026-118994—CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameEPSS 0.2%CVE-2026-118990—CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backupEPSS 0.2%CVE-2026-118986—CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()EPSS 0.2%