The vulnerability arises because CallBackery generates the session cookie signing secret by calling the non-cryptographic rand() function twice, which is seeded with only 32 bits. As a result, the secret can have at most 2^32 possibilities, and a single captured signed cookie is enough to brute‑force the secret offline, after which an attacker can sign arbitrary cookies. This flaw enables an attacker to impersonate any user, including privileged accounts, thereby compromising confidentiality, integrity, and availability of the system. The weakness is an instance of CWE‑338 (Prediction or Guessing of a Secret).

CallBackery for Perl, versions prior to 0.62.0. No other vendors or products are listed as affected.

Because the secret’s entropy is limited to 32 bits, brute‑forcing it is computationally trivial; an attacker only needs a single valid session cookie to recover the secret and forge any number of additional cookies. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, requiring the attacker to obtain a session cookie in transit or via client‑side exploitation. The risk is high due to the ease of exploitation and the severity of potential impact.