The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.
An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to CallBackery 0.62.0 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 30 Oct 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline. An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator. | |
| Title | CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand() | |
| Weaknesses | CWE-338 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-30T13:13:32.845Z
Reserved: 2026-10-29T10:48:23.002Z
Link: CVE-2026-118986
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-30T14:16:41.543
Modified: 2026-10-30T14:16:41.543
Link: CVE-2026-118986
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-30T14:30:08Z