CVE-2026-13576

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes

State: Published
Severity: Not scored
Published: Oct 30, 2026
Updated: Oct 30, 2026
Reserved: Jun 28, 2026

Description

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.

Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.

An attacker who obtains the user table can recover passwords by fast offline guessing.

Scores

The record has no CVSS score.

Weaknesses

CWE-916 Use of Password Hash With Insufficient Computational Effort
CWE-759 Use of a One-Way Hash without a Salt

Affected Products

Product	Versions
CallBackery	before 0.62.0Affected

References

https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changesrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.