{"id":"CVE-2026-118986","published":"2026-10-30T14:16:41.543","lastModified":"2026-10-30T17:08:54.633","description":"CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().\n\nThe secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.\n\nAn attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-338"],"vendors":[],"products":[],"references":[{"url":"https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}