{
   "document": {
      "category": "csaf_security_advisory",
      "csaf_version": "2.0",
      "distribution": {
         "tlp": {
            "label": "WHITE",
            "url": "https://www.first.org/tlp/"
         }
      },
      "lang": "en",
      "notes": [
         {
            "category": "description",
            "text": "CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.\n\nAn attacker who obtains the user table can recover passwords by fast offline guessing.",
            "title": "Vulnerability Description"
         }
      ],
      "publisher": {
         "category": "other",
         "contact_details": "gdt@cpan.org",
         "name": "giterlizzi",
         "namespace": "https://github.com/giterlizzi/"
      },
      "references": [
         {
            "category": "self",
            "summary": "CPANSA-CallBackery-2026-13576 JSON",
            "url": "https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-callbackery-2026-13576.json"
         },
         {
            "category": "external",
            "summary": "https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes",
            "url": "https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes"
         },
         {
            "category": "external",
            "summary": "CVE-2026-13576 (NVD)",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13576"
         }
      ],
      "title": "CallBackery vulnerability",
      "tracking": {
         "current_release_date": "2026-10-30T00:00:00",
         "generator": {
            "engine": {
               "name": "CSAF Perl Toolkit",
               "version": "0.26"
            }
         },
         "id": "CPANSA-CallBackery-2026-13576",
         "initial_release_date": "2026-10-30T00:00:00",
         "revision_history": [
            {
               "date": "2026-10-30T00:00:00",
               "number": "1",
               "summary": "First release"
            }
         ],
         "status": "final",
         "version": "1"
      }
   },
   "product_tree": {
      "branches": [
         {
            "branches": [
               {
                  "category": "product_version_range",
                  "name": "vers:cpan/<0.62.0",
                  "product": {
                     "name": "CallBackery less than 0.62.0",
                     "product_id": "CSAFPID-0001",
                     "product_identification_helper": {
                        "purl": "pkg:cpan/CallBackery"
                     }
                  }
               },
               {
                  "category": "product_version_range",
                  "name": "vers:cpan/>=0.62.0",
                  "product": {
                     "name": "CallBackery greater than or equal 0.62.0",
                     "product_id": "CSAFPID-0002",
                     "product_identification_helper": {
                        "purl": "pkg:cpan/CallBackery"
                     }
                  }
               }
            ],
            "category": "product_name",
            "name": "CallBackery"
         }
      ]
   },
   "vulnerabilities": [
      {
         "cve": "CVE-2026-13576",
         "cwe": {
            "id": "CWE-759",
            "name": "Use of a One-Way Hash without a Salt"
         },
         "notes": [
            {
               "category": "description",
               "text": "CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.\n\nPasswords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.\n\nAn attacker who obtains the user table can recover passwords by fast offline guessing.",
               "title": "Vulnerability Description"
            }
         ],
         "product_status": {
            "fixed": [
               "CSAFPID-0002"
            ],
            "known_affected": [
               "CSAFPID-0001"
            ]
         }
      }
   ]
}