The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.
An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
Upgrade to CallBackery 0.62.0 or later.
Workaround
No workaround given by the vendor.
Fri, 30 Oct 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline. An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator. | |
| Title | CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand() | |
| Weaknesses | CWE-338 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-30T13:13:32.845Z
Reserved: 2026-10-29T10:48:23.002Z
Link: CVE-2026-118986
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-30T14:16:41.543
Modified: 2026-10-30T14:16:41.543
Link: CVE-2026-118986
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-30T14:30:08Z