CVE Watch6 de nov. de 2026

CVE-2026-118987

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a c

CVSS

5.3

Média

EPSS

0.3%

p17

KEV

—

Exploit Today

0-100

Publicado: 30 de out. de 2026 · Última mod.: 6 de nov. de 2026

EPSS · 30d

0.2%EPSS · 30 dias0.3%

2026-10-312026-11-07

Descrição técnica

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is. A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.

Referências oficiais

metacpan.orghttps://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes

CVEs relacionados

Nenhum CVE relacionado por CWE ou produto.