{"id":"CVE-2026-13576","aliases":["EUVD-2026-113913","GHSA-6v4f-gp6f-2gvj"],"status":"published","title":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes","description":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.\n\nAn attacker who obtains the user table can recover passwords by fast offline guessing.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00201,"percentile":0.10058,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-759","CWE-916"],"published":"2026-10-30T13:09:47Z","modified":"2026-11-06T16:54:36Z","references":[{"url":"https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes","tags":["release-notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13576"},{"url":"https://github.com/advisories/GHSA-6v4f-gp6f-2gvj"}],"sources":{"cve":[{"id":"CVE-2026-13576","title":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes","description":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.\n\nAn attacker who obtains the user table can recover passwords by fast offline guessing.","status":"published","published":"2026-10-30T13:09:47.702Z","modified":"2026-11-06T16:54:36.135Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-916","CWE-759"],"updated_at":"2026-11-06T17:28:52.735903Z"}],"euvd":[{"id":"EUVD-2026-113913","description":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.\n\nAn attacker who obtains the user table can recover passwords by fast offline guessing.","status":"published","published":"2026-10-30T13:09:47Z","modified":"2026-11-06T16:54:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-06T18:05:41.257798Z"}],"ghsa":[{"id":"GHSA-6v4f-gp6f-2gvj","title":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n...","description":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.\n\nAn attacker who obtains the user table can recover passwords by fast offline guessing.","status":"published","published":"2026-10-30T15:34:31Z","modified":"2026-11-06T18:35:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-759"],"updated_at":"2026-11-06T19:01:26.771329Z"}],"nvd":[{"id":"CVE-2026-13576","description":"CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.\n\nAn attacker who obtains the user table can recover passwords by fast offline guessing.","status":"published","published":"2026-10-30T13:18:32.9Z","modified":"2026-11-06T17:17:25.657Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-759","CWE-916"],"updated_at":"2026-11-06T20:01:15.785017Z"}]}}