CallBackery versions before 0.62.0 for Perl have a vulnerability in the session cookie signing mechanism. The signing secret is generated using the built-in rand() function seeded with 32 bits, resulting in a limited secret space of at most 2^32 values. An attacker who obtains a single signed session cookie can perform an offline brute-force attack to recover the secret and then forge session cookies for any user, including administrators.