CVE-2026-118986
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
- State
- Published
- Severity
- Not scored
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 29, 2026
Description
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().
The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.
An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.
Scores
The record has no CVSS score.
Weaknesses
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Affected Products
| Product | Versions |
|---|---|
CallBackery |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.