{"id":"CVE-2026-13576","aliases":[],"cve":{"records":[{"id":"CVE-2026-13576","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-28T20:49:43.680Z","published":"2026-10-30T13:09:47.702Z","modified":"2026-11-06T16:54:36.135Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-30T13:09:47.702Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-06T16:54:36.135Z"}],"references":[{"url":"https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes","tags":["release-notes"],"source":"CPANSec"}],"weaknesses":[{"id":"CWE-916","description":"CWE-916 Use of Password Hash With Insufficient Computational Effort","source":"CPANSec"},{"id":"CWE-759","description":"CWE-759 Use of a One-Way Hash without a Salt","source":"CPANSec"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-06T16:54:07.521022Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.\n\nAn attacker who obtains the user table can recover passwords by fast offline guessing.","score":7.5,"severity":"high","published":"2026-10-30T13:09:47.702Z","modified":"2026-11-06T16:54:36.135Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"CallBackery","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.62.0","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/CallBackery","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-13576"}],"remediation":[{"text":"Upgrade to CallBackery 0.62.0 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-13576"}],"references":["https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes"],"sources":[{"name":"CVE","id":"CVE-2026-13576","modified":"2026-11-06T16:54:36.135Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-13576"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-06T18:04:13.320Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T16:05:31.753Z","attemptedAt":"2026-10-30T16:05:31.753Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T16:05:31.930Z","attemptedAt":"2026-10-30T16:05:31.930Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T16:05:31.492Z","attemptedAt":"2026-10-30T16:05:31.492Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T16:05:31.359Z","attemptedAt":"2026-10-30T16:05:31.359Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113913","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113913","modified":"Oct 30, 2026, 3:34:31 PM","checkedAt":"2026-10-30T16:05:31.492Z"},{"source":"NVD","id":"CVE-2026-13576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13576","modified":"2026-10-30T13:18:32.900","checkedAt":"2026-10-30T16:05:31.753Z"},{"source":"GitHub Advisory Database","id":"GHSA-6v4f-gp6f-2gvj","url":"https://github.com/advisories/GHSA-6v4f-gp6f-2gvj","modified":"2026-10-30T15:34:39Z","checkedAt":"2026-10-30T16:05:31.930Z"}],"aiSummary":{"text":"CallBackery for Perl before version 0.62.0 stores user passwords as unsalted HMAC-SHA1 hashes, allowing an attacker with access to the user table to recover passwords through fast offline guessing. The lack of salt and work factor in the hashing process makes it vulnerable. An attacker needs access to the user table to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T15:11:20.523Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-13576"}]}}