{"id":"CVE-2026-13576","published":"2026-10-30T13:18:32.900","lastModified":"2026-10-30T17:08:54.633","description":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.\n\nAn attacker who obtains the user table can recover passwords by fast offline guessing.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-759","CWE-916"],"vendors":[],"products":[],"references":[{"url":"https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}