CallBackery versions before 0.62.0 for Perl are vulnerable to log injection via newlines in the login name. The login() function writes the login name to application logs without escaping control characters, allowing an unauthenticated attacker to forge log records, including fake administrator login entries.