CVE-2026-13576

Description

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing.

Is your site exposed to CVE-2026-13576?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-759 CWE-759

CWE-916 CWE-916

References

Other References

https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes

Frequently Asked Questions

What is CVE-2026-13576? +

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing.

How do I check if I'm vulnerable to CVE-2026-13576? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-5922

Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and requires a …

CVE-2025-15544

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted …

CVE-2025-15631

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does …

CVE-2026-45787 9.1

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and …

CVE-2025-10205 8.8

Use of a One-Way Hash with a Predictable Salt vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. and newer …

CVE-2025-34208 7.5

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store user passwords using unsalted SHA-512 hashes with a …