CVE-2026-13576— CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes

Quick assessment

Affected

CVE-2026-13576

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 版本的 CallBackery 在 0.62.0 之前的版本中，将用户密码以无盐 HMAC-SHA1 哈希形式存储。密码使用来自 Mojo::Util 的函数进行哈希处理，未提供密钥，仅生成一次快速的 SHA-1 HMAC。由于未使用盐值，相同密码会产生相同的哈希值，且没有任何工作因子（work factor）来减缓密码猜测速度。攻击者一旦获取用户表，即可通过快速的离线猜解恢复用户密码。

AI Predicted 5.3 Difficulty: Moderate EPSS 0.10% · P1 Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1110.001 · Password Guessing

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`< 0.62.0`	affected

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes

Source: CVE Program / CVE List V5

Vulnerability Description

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

使用具有不充分计算复杂性的口令哈希

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 0.62.0	-

II. Public POCs for CVE-2026-13576

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-13576

请登录查看更多情报信息。

Other References for CVE-2026-13576 (1)

https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes release-notes

https://www.cve.org/CVERecord?id=CVE-2026-13576

IV. Related Vulnerabilities

Same weakness: CWE-916