CVE-2026-118991 Details
Description
CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed. An attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds.
A vulnerability exists in CallBackery versions prior to 0.62.0 for Perl, where configuration backups are encrypted using a padded password as the AES key. The encryption process involves padding the backup password with 'x' characters and truncating it to 32 bytes, without the use of salt or key derivation. This allows for fast offline password guessing by decrypting one block of the backup, which confirms a password guess at raw AES speed. An attacker who obtains a backup can recover its password, gaining access to all credentials stored in the backup.
Users can update to CallBackery version 0.62.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CallBackery | < 0.62.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | CPANSec |