CVE-2026-118991
Received Received - Intake

Backup Password Recovery in CallBackery via AES Key Weakness

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed. An attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118991
EUVD
EUVD-2026-113919

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
callbackery callbackery to 0.62.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-916 The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CallBackery versions before 0.62.0 for Perl have a flaw where configuration backups are encrypted using the padded password as the AES key. The password is padded with 'x' characters to 32 bytes with no salt or key derivation. The first block of a backup contains a 16 hex digit length field, allowing attackers to confirm password guesses at raw AES speed.

Impact Analysis

An attacker who gains access to a backup can recover its password through fast offline guessing. Once the password is obtained, the attacker can decrypt the backup and access all credentials stored within it.

Mitigation Strategies

Upgrade CallBackery to version 0.62.0 or later to address the encryption weakness in configuration backups. Remove any existing backups that may have been created with vulnerable versions to prevent offline password recovery attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart