CVE-2026-118986

HighCVSS 7.5/10Last modified Nov 6, 2026

Description

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().

The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.

An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-338

Affected software

VendorProductVersions
——< 0.62.0

References

Timeline

Published
Oct 30, 2026
Last modified
Nov 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1189875.3CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cCVE-2026-1189887.5CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. EverCVE-2026-1189895.5WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_fCVE-2026-118994.3The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all veCVE-2026-1189905.5CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration baCVE-2026-1189917.5CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backCVE-2026-1189928.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoCVE-2026-1189937.5CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FasCVE-2026-1189949.8CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the applicCVE-2026-1189959.1CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is doCVE-2026-1189964.9CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfiCVE-2026-11903.1A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language
CVE-2026-118986: High severity, CVSS 7.5 | Vulnix