CVE-2026-13576
Severity not reportedData quality: partial.
Some fields were not provided by the source.
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing.
CVSS
—
Not reported by the source
Timeline (UTC)
Published: 2026-10-30 13:18
Modified: 2026-10-30 17:08
NVD status: Deferred
Last synced 1 day ago
Verified against the source API 2026-11-03 07:35 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes 9b29abf9-4ab0-4765-b253-1875cd9b441e
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 07:35 UTC · record ↗