CallBackery modules earlier than version 0.62.0 accept session cookies presented in an X‑Session‑Cookie header regardless of their age. The internal cookieConf() routine only enforces a 300‑second expiry limit when the cookie is supplied as an xsc query parameter, but skips this check for header‑based cookies. Consequently, an attacker who obtains a valid cookie through a log leak, Referer header, or browser history can replay the cookie to log in as the legitimate user for an unlimited period. This represents a classic authentication bypass flaw (CWE‑1463) that undermines the confidentiality, integrity, and availability of the user’s session data.

The vulnerability affects the Perl CallBackery toolkit in all releases prior to 0.62.0. Users who deploy CallBackery via CPAN or other Perl packaging mechanisms and run code that relies on the X‑Session‑Cookie header are vulnerable. The fix is available in 0.62.0 and later, where the module checks cookie age for both query and header inputs.

Because the flaw is purely a server‑side configuration and validation issue, an attacker needs only to supply a valid session identifier via HTTP headers and may not even need to authenticate to the application. The condition is satisfied once a cookie value is known, which can be obtained from exposed logs, Referer headers, or client history. No elevated privileges or complex exploitation steps are required, making the attack straightforward. EPSS data is not available, and the vulnerability is not listed in KEV. The potential to hijack long‑term sessions without any countermeasures signifies a high risk for environments where CallBackery is exposed to client requests.