Quick answers
- Is CVE-2026-13576 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13576 being exploited in the wild.
- How severe is CVE-2026-13576?
- Informational severity, published 30 October 2026.
- Which products and versions are affected?
- OETIKER CallBackery before 0.62.0.
- Is there a fix for CVE-2026-13576?
- Yes: fixed in CallBackery 0.62.0. Until then: Old password hashes continue to work at login and are automatically replaced with the new salted scrypt hash upon successful authentication. Delete any world-readable backup files from /tmp/cbdump* that may have been left by older versions.</anigation> <parameter name="timeline">[{"kind": "advisory", "at": "2026-10-30"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13576 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-13576?
- Check whether you run OETIKER CallBackery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: CallBackery 0.62.0
Old password hashes continue to work at login and are automatically replaced with the new salted scrypt hash upon successful authentication. Delete any world-readable backup files from /tmp/cbdump* that may have been left by older versions.</anigation> <parameter name="timeline">[{"kind": "advisory", "at": "2026-10-30"}]
Technical details
Passwords are hashed using hmac_sha1_sum() from Mojo::Util with no cryptographic key, no salt, and no work factor. This allows identical passwords to produce identical hashes, and enables rapid offline password cracking once the user table is compromised. The fix upgrades to salted scrypt hashing, which is substantially more resistant to offline attacks.
Affected products
- OETIKER CallBackery before 0.62.0