CallBackery versions before 0.62.0 store user passwords as unsalted HMAC‑SHA1 hashes using hmac_sha1_sum() with no key. The hashes are identical for equal passwords and lack any work factor, making them vulnerable to offline brute‑force or dictionary attacks. While the vendor does not recommend storing passwords in clear text, the use of an unsalted fast hash permits rapid credential harvesting if the password storage is exfiltrated.

All CallBackery releases prior to version 0.62.0 are affected. The product is a Perl library used for authentication, and the vulnerability applies to any deployment that relies on the default password hashing routine in these versions.

The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires possession of the stored password table. This could arise from a database breach, misconfigured database permissions, or an administrative data exposure, which are inferred based on common attack scenarios. Once the table is obtained, the unsalted hashes enable rapid recovery of plain‑text passwords. The risk level depends on the number of exposed accounts and the sensitivity of the protected services. The absence of a CVSS score prevents a precise severity rating, but the potential for credential compromise is high.