What is GHSA-67p6-38wc-57c7?

GHSA-67p6-38wc-57c7 is a security advisory published by GitHub Security Advisories with unknown severity. CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X...

Which CVE IDs does GHSA-67p6-38wc-57c7 cover?

GHSA-67p6-38wc-57c7 covers the following CVE IDs: CVE-2026-118987. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-67p6-38wc-57c7unknown

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X...

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-118987 →

📋 Description

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header.

cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is.

A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-118987
https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes
https://github.com/advisories/GHSA-67p6-38wc-57c7