CallBackery versions prior to 0.62.0 for Perl use a weak method to encrypt configuration backups by deriving the AES key directly from the backup password padded with 'x' characters and truncated to 32 bytes, without salt or key derivation. This allows an attacker who obtains a backup to perform fast offline password guessing at raw AES speed, potentially recovering all credentials stored in the backup.