CVE-2026-118991

HighCVSS 7.5/10Last modified Nov 6, 2026

Description

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key.

getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed.

An attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-916

Affected software

Vendor	Product	Versions
—	—	< 0.62.0

References

https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes

Timeline

Published: Oct 30, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1189928.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. resto CVE-2026-1189937.5CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, Fas CVE-2026-1189949.8CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the applic CVE-2026-1189959.1CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is do CVE-2026-1189964.9CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfi CVE-2026-11903.1A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language CVE-2026-119004.3The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and incl CVE-2026-119015.3The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and includi CVE-2026-1190179.9Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the contex CVE-2026-1190257.5open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafte CVE-2026-1190277.5oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted serve CVE-2026-1190288.8oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enu