cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is.
A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
Upgrade to CallBackery 0.62.0 or later and set max_session_age in the BACKEND section.
Workaround
No workaround given by the vendor.
Fri, 30 Oct 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is. A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely. | |
| Title | CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header | |
| Weaknesses | CWE-1463 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-30T13:13:11.338Z
Reserved: 2026-10-29T10:48:23.002Z
Link: CVE-2026-118987
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-30T14:16:41.670
Modified: 2026-10-30T14:16:41.670
Link: CVE-2026-118987
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-30T14:30:08Z