The vulnerability occurs when the login RPC writes the supplied name directly into the application log without escaping. Since the RPC does not require authentication, an attacker can insert a newline in the name, causing the rest of the line to be interpreted as a new log record. The forged entry can masquerade as a successful administrator login from any address, potentially misleading analysts or enabling other attacks that rely on the log as a source of truth.

All installations of CallBackery for Perl that are version 0.61.99 or earlier are affected. The vendor is OETIKER. Upgrading to 0.62.0 or later removes the flaw.

This flaw allows unauthenticated attackers to manipulate logs, a critical source for auditing and security forensics. While no exploit score or CVSS is published, the lack of authentication and straightforward injection path make the vulnerability highly exploitable. The EPSS score is not available, and the flaw is not listed in CISA KEV, but the potential for misrepresentation of administrative activity warrants immediate attention.