Is CVE-2026-118987 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118987 being exploited in the wild.

How severe is CVE-2026-118987?

Informational severity, published 30 October 2026.

Which products and versions are affected?

OETIKER CallBackery before 0.62.0.

How is CVE-2026-118987 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118987?

Check whether you run OETIKER CallBackery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118987: CallBackery session cookie age validation bypass in X-Session-Cookie header

CVE-2026-118987 · Severity: info · Published 2026-10-30

CallBackery is a web application framework for Perl. Versions before 0.62.0 accept session cookies of any age when sent in the X-Session-Cookie header, whereas the same cookies are properly rejected when sent as query parameters. An attacker who obtains a leaked session cookie—from logs, browser history, or referrer headers—can use it to authenticate as the legitimate user indefinitely, gaining full access to the application.

Technologies: OETIKER CallBackery. Vendors: OETIKER.

Quick answers

Is CVE-2026-118987 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118987 being exploited in the wild.
How severe is CVE-2026-118987?: Informational severity, published 30 October 2026.
Which products and versions are affected?: OETIKER CallBackery before 0.62.0.
Is there a fix for CVE-2026-118987?: Yes: fixed in 0.62.0. Until then: Enable the BACKEND setting max_session_age to specify a session timeout in seconds; without this setting, sessions do not expire by default in versions before 0.62.0. Configure web server logging to exclude sensitive headers and audit logs for leaked session cookies. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118987 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118987?: Check whether you run OETIKER CallBackery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.62.0

Enable the BACKEND setting max_session_age to specify a session timeout in seconds; without this setting, sessions do not expire by default in versions before 0.62.0. Configure web server logging to exclude sensitive headers and audit logs for leaked session cookies.

Technical details

The vulnerability exists in the cookieConf() function, which enforces a 300-second maximum age for session cookies arriving as xsc query parameters but fails to apply the same validation to cookies sent via the X-Session-Cookie HTTP header. An unauthenticated attacker with a captured session cookie can bypass expiration controls by transmitting it in the header, allowing indefinite session reuse. The fix in version 0.62.0 aligns cookie validation across both transport mechanisms.

Affected products

Oetiker CallBackery before 0.62.0

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.