CallBackery for Perl accepts aged session cookies in a header
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
CallBackery versions before 0.62.0 for Perl accept session cookies of any age when they are sent in the X-Session-Cookie header. The age check that rejects cookies older than 300 seconds runs only for the xsc query parameter, so the same cookie is accepted indefinitely through the header. A remote attacker who obtains a session cookie from a log, a Referer header or browser history can authenticate as that user without any privileges or user interaction. The weakness is classified as CWE-1463, Insufficient Session Timeout Value.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is. A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | CallBackery | before 0.62.0 | 0.62.0 | Patch available | CNA |
- CallBackery Vendor— Affected before 0.62.0 Fixed in 0.62.0 Patch available CNA
Remediation
Update CallBackery for Perl to version 0.62.0 or later, which fixes the issue. The sources list no advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA CallBackery Fixed in 0.62.0
Timeline
- 2026-10-30 Threatist record created from CVE-2026-118987
- 2026-10-30 Alias added: GHSA-67p6-38wc-57c7
- 2026-11-06 CVSS score added · CISA ADP
- 2026-11-06 CISA SSVC decision points changed
References
Sources
- CVE-2026-118987 · CVE Program
- CVE-2026-118987 · NVD
- FIRST EPSS
- GHSA-67p6-38wc-57c7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences