CVE-2026-13576
Received Received - Intake

Weak Password Hashing in CallBackery Before 0.62.0

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-13576
EUVD
EUVD-2026-113913

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
callbackery callbackery to 0.62.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-916 The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
CWE-759 The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed using hmac_sha1_sum() from Mojo::Util without a key, making them vulnerable to fast offline guessing attacks. Equal passwords produce identical hashes due to the lack of salt.

Detection Guidance

Check if your CallBackery version is before 0.62.0 by running: grep -r 'callbackery' /path/to/installation or checking package manager logs. Inspect password storage in the user table for unsalted HMAC-SHA1 hashes by querying the database directly.

Impact Analysis

An attacker who gains access to the user table can recover passwords through offline guessing attacks. This compromises user accounts and sensitive data, potentially leading to unauthorized access and further exploitation.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for secure password storage. Unsalted hashes and weak cryptographic methods fail to meet data protection standards, risking non-compliance and potential legal consequences.

Mitigation Strategies

Upgrade CallBackery to version 0.62.0 or later immediately. Rotate all user passwords after upgrade. Ensure new passwords are stored with a salt and a strong hashing algorithm like bcrypt or Argon2.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart