CallBackery versions prior to 0.62.0 for Perl store user passwords using unsalted HMAC-SHA1 hashes without a key, resulting in identical hashes for identical passwords and no computational delay to slow guessing attacks. This weak password hashing approach allows an attacker who gains access to the user table to efficiently perform offline password guessing.