CVE-2026-13576 Details
Description
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing.
A vulnerability exists in CallBackery versions prior to 0.62.0 for Perl, where user passwords are stored as unsalted HMAC-SHA1 hashes. The hashing is performed using hmac_sha1_sum() from Mojo::Util without a key, resulting in a single fast SHA-1 HMAC. The absence of salt means that identical passwords produce identical hashes, and there is no work factor to slow down guessing. Consequently, an attacker who gains access to the user table can quickly recover passwords through rapid offline guessing.
Passwords are now stored as salted scrypt hashes, in a format compatible with the HIN Access Gateway. Each login attempt with an old hash now costs one scrypt check, adding a layer of security. Users can update their passwords by logging in, as the old hash is replaced with the new salted scrypt version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-759 | Use of a One-Way Hash without a Salt | CPANSec |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CallBackery | < 0.62.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | CPANSec |