Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.
An attacker who obtains the user table can recover passwords by fast offline guessing.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to CallBackery 0.62.0 or later.
Workaround
No workaround given by the vendor.
Fri, 30 Oct 2026 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing. | |
| Title | CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes | |
| Weaknesses | CWE-759 CWE-916 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-30T13:09:47.702Z
Reserved: 2026-06-28T20:49:43.680Z
Link: CVE-2026-13576
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-10-30T13:18:32.900
Modified: 2026-10-30T17:08:54.633
Link: CVE-2026-13576
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-30T15:00:15Z