The flaw lies in the encryption of CallBackery configuration backups, where the backup password is padded with "x" characters and truncated to 32 bytes to form an AES key, without any salting or key‑derivation function. The first block of a backup contains a 16‑hex‑digit length field, allowing an attacker to test password guesses at raw AES speed. This weakness, identified as CWE‑916, permits offline brute‑force password recovery, resulting in the exposure of every credential stored within the backup.

Any installation of CallBackery earlier than version 0.62.0 that uses the Perl encrypt configuration backup mechanism is affected. The impact applies across all operating systems where the product is deployed, as the vulnerability resides in the backup format rather than in the runtime environment.

The EPSS score for this issue is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no current evidence of exploitation. Nevertheless, the design flaw allows a determined attacker who obtains a backup file to recover the backup password through offline guessing. Once the password is recovered, the attacker gains access to all stored credentials. The attack vector is inferred to be offline, requiring possession of a backup file rather than a direct network foothold.