CVE-2026-118986: falha de alta gravidade em CallBackery
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.2%
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().
The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.
An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
CallBackeryCVEs relacionadas — CallBackery
No mesmo produto, das mais perigosas para as menos.
CVE-2026-118995CRITICALCallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidatorEPSS 0.3%CVE-2026-118988HIGHCallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc routeEPSS 0.2%CVE-2026-118992HIGHCallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backupEPSS 0.2%CVE-2026-118994CRITICALCallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameEPSS 0.2%CVE-2026-118990MEDIUMCallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backupEPSS 0.2%CVE-2026-118987MEDIUMCallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie headerEPSS 0.2%