CVE-2026-118987 in CallBackery
Summary
by MITRE • 10/30/2026
CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header.
cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is.
A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in CallBackery versions prior to 0.62.0 represents a critical authentication bypass stemming from inconsistent validation logic applied to different input vectors for the same security-critical data. Specifically, the application implements session management through two distinct mechanisms: one utilizing the xsc query parameter and another relying on the X-Session-Cookie HTTP header. While the code path handling the xsc parameter correctly enforces a temporal constraint by rejecting cookies older than 300 seconds, the logic governing the X-Session-Cookie header completely omits this age verification step. This discrepancy creates an asymmetric security posture where the method of transmission dictates the level of protection afforded to the session token, allowing attackers to bypass time-based expiration controls simply by shifting their attack vector from URL parameters to HTTP headers.
From a technical perspective, this flaw is classified under CWE-613, which denotes Insufficient Session Expiration. The root cause lies in the application's failure to apply uniform security policies across all entry points for session authentication data. In secure software design, validation logic such as timestamp verification must be centralized or consistently replicated across all code paths that process sensitive inputs. By neglecting this check for header-based cookies, the developers have introduced a predictable weakness where the integrity of the session state is compromised not by cryptographic failure but by logical oversight. This type of error often arises when security features are added incrementally to existing functionality without a comprehensive review of all authentication pathways, leading to fragmented enforcement mechanisms that can be easily circumvented by an adversary aware of these implementation details.
The operational impact of this vulnerability is severe, as it effectively nullifies the intended lifetime restrictions on user sessions. In typical web applications, session cookies are designed with short lifespans to limit the window of opportunity for attackers who may obtain a token through various means such as cross-site scripting attacks, network sniffing in unsecured environments, or log leakage. When an attacker obtains a valid session cookie from sources like server logs, browser history, or Referer headers sent by other users, they can utilize this stale credential to authenticate as the victim indefinitely. This indefinite persistence of access allows for persistent unauthorized control over user accounts, leading to potential data breaches, privilege escalation if administrative roles are involved, and complete compromise of the confidentiality and integrity associated with that identity. The lack of expiration means that even after a legitimate user logs out or changes their password, an attacker retaining the old cookie may still maintain active access until they manually clear it or the application is patched.
This vulnerability aligns closely with MITRE ATT&CK technique T1078, specifically Valid Accounts and potentially T1539 if accessed via network sniffing, as well as CWE-20 for Improper Input Validation regarding the failure to validate temporal constraints on session tokens. To mitigate this issue, developers must ensure that all methods of transmitting authentication credentials undergo identical validation checks. The code handling the X-Session-Cookie header should be updated to include the same age verification logic present in the xsc parameter processing routine. Additionally, implementing secure cookie attributes such as HttpOnly and Secure can help reduce the risk of initial token leakage through client-side scripts or non-HTTPS connections. Regular security audits focusing on authentication flows are essential to identify similar inconsistencies where different code paths handle sensitive data with varying levels of scrutiny, ensuring that no single vector becomes a weak link in the overall defense strategy.