Vulnerability · Published Oct 30, 2026 · Assigned by CPANSec
CVE-2026-118987CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
Unrated
In plain English
A security flaw in CallBackery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 95.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is. A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CallBackery | 0 – before 0.62.0 |
Weakness: CWE-1463