CallBackery stores passwords as unsalted HMAC-SHA1, tracked as EUVD-2026-113913

Summary

EUVD-2026-113913, updated 2026-10-30, describes user passwords stored as unsalted HMAC-SHA1 hashes in CallBackery versions before 0.62.0 for Perl. The entry states that an attacker who obtains the hashes can guess passwords quickly because there is no salt or work factor.

If you use CallBackery

Upgrade CallBackery to version 0.62.0 or later

Reset user passwords after upgrading, since existing hashes are weak

Review logs for unusual getUserConfig calls and rotate passwords if exposure is suspected

Validate form input server-side until patched

Treat application logs as untrusted input when reviewing login records

Restrict request sizes and rate-limit requests to the application until patched

What the sources say 11

Oct 30, 2026, 3:04 PM UTC · Mastodon: “CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().” Source

Oct 30, 2026, 3:04 PM UTC · Mastodon: “CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header.” Source

Oct 30, 2026, 3:04 PM UTC · Mastodon: “CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup.” Source

Oct 30, 2026, 3:04 PM UTC · Mastodon: “CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key.” Source

Oct 30, 2026, 3:04 PM UTC · Mastodon: “CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.” Source

Oct 30, 2026, 3:05 PM UTC · Mastodon: “CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI.” Source

Oct 30, 2026, 3:05 PM UTC · Mastodon: “CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.” Source

Oct 30, 2026, 3:05 PM UTC · Mastodon: “CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator.” Source

Oct 30, 2026, 3:05 PM UTC · Mastodon: “CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig.” Source

Oct 30, 2026, 3:05 PM UTC · Mastodon: “CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.” Source

Oct 30, 2026, 4:06 PM UTC · Mastodon: “CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.” Source