CallBackery versions before 0.62.0 for Perl accept session cookies of any age when sent in the X-Session-Cookie header, allowing indefinite authentication if a session cookie leaks through logs, Referer headers, or browser history. The cookieConf() function only rejects old cookies when sent via the xsc query parameter, not the header.