CVE-2026-75866 (GCVE-0-2026-75866)

Vulnerability from cvelistv5 – Published: 2026-08-22 13:52 – Updated: 2026-08-25 19:29
VLAI
Title
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them
Summary
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token dispatches on the grant_type in the request body, so a client registered for authorization_code alone can ask for client_credentials, and that arm passes the requested scope straight to the minter, which signs it into the at+jwt access token. authorize copies the query scope into the authorization code record without comparing it against the registration, leaving the optional consent hook as the only check between an arbitrary scope and the issued code. redirect_uris on the same client row is read and enforced. A registered client can obtain a correctly signed token carrying any scope it names, and a resource server running Punk::OAuth2::Checker accepts that token and honours the scope. A client registered without a secret authenticates on its client_id alone, so anyone who knows that identifier can request one.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 19:29 UTC
CWE
Assigner
CPANSec CNA under the redhat root
CNA scorecard C 63/100 over 300 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Affected: 0 , ≤ 0.03 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-22T19:07:08.861Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/22/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-75866",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T19:29:05.610651Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:29:36.357Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Punk::OAuth2::Server"
          ],
          "packageName": "Punk-OAuth2",
          "packageURL": "pkg:cpan/Punk-OAuth2",
          "programFiles": [
            "include/pox/pox_server.h"
          ],
          "programRoutines": [
            {
              "name": "Punk::OAuth2::Server::token"
            },
            {
              "name": "Punk::OAuth2::Server::authorize"
            }
          ],
          "versions": [
            {
              "lessThanOrEqual": "0.03",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client\u0027s registered scopes and grant types because no authorization path reads them.\n\nPunk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token dispatches on the grant_type in the request body, so a client registered for authorization_code alone can ask for client_credentials, and that arm passes the requested scope straight to the minter, which signs it into the at+jwt access token. authorize copies the query scope into the authorization code record without comparing it against the registration, leaving the optional consent hook as the only check between an arbitrary scope and the issued code. redirect_uris on the same client row is read and enforced.\n\nA registered client can obtain a correctly signed token carrying any scope it names, and a resource server running Punk::OAuth2::Checker accepts that token and honours the scope. A client registered without a secret authenticates on its client_id alone, so anyone who knows that identifier can request one."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T13:52:49.922Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/LNATION/Punk-OAuth2-0.04/changes"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://metacpan.org/release/LNATION/Punk-OAuth2-0.03/view/lib/Punk/OAuth2/Server/Store.pm"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://datatracker.ietf.org/doc/html/rfc6749#section-3.3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://datatracker.ietf.org/doc/html/rfc6749#section-5.2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Punk-OAuth2 0.04 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client\u0027s registered scopes and grant types because no authorization path reads them",
      "workarounds": [
        {
          "lang": "en",
          "value": "In a proxy ahead of Punk::OAuth2::Server, reject a token or authorization request that asks for a grant type or scope the client is not registered for."
        }
      ],
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-75866",
    "datePublished": "2026-08-22T13:52:49.922Z",
    "dateReserved": "2026-08-18T11:17:09.339Z",
    "dateUpdated": "2026-08-25T19:29:36.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-75866",
      "date": "2026-10-26",
      "epss": "0.00495",
      "percentile": "0.422"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://cpan.org/modules",
                "defaultStatus": "unaffected",
                "modules": [
                  "Punk::OAuth2::Server"
                ],
                "packageName": "Punk-OAuth2",
                "packageURL": "pkg:cpan/Punk-OAuth2",
                "programFiles": [
                  "include/pox/pox_server.h"
                ],
                "programRoutines": [
                  {
                    "name": "Punk::OAuth2::Server::token"
                  },
                  {
                    "name": "Punk::OAuth2::Server::authorize"
                  }
                ],
                "versions": [
                  {
                    "lessThanOrEqual": "0.03",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client\u0027s registered scopes and grant types because no authorization path reads them.\n\nPunk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token dispatches on the grant_type in the request body, so a client registered for authorization_code alone can ask for client_credentials, and that arm passes the requested scope straight to the minter, which signs it into the at+jwt access token. authorize copies the query scope into the authorization code record without comparing it against the registration, leaving the optional consent hook as the only check between an arbitrary scope and the issued code. redirect_uris on the same client row is read and enforced.\n\nA registered client can obtain a correctly signed token carrying any scope it names, and a resource server running Punk::OAuth2::Checker accepts that token and honours the scope. A client registered without a secret authenticates on its client_id alone, so anyone who knows that identifier can request one."
          },
          {
            "lang": "es",
            "value": "Las versiones de Punk::OAuth2::Server hasta la 0.03 para Perl emiten tokens de acceso fuera de los \u00e1mbitos y tipos de concesi\u00f3n registrados de un cliente porque ninguna ruta de autorizaci\u00f3n los lee.\n\nPunk::OAuth2::Server::Store registra \u00e1mbitos y grant_types por cliente y documenta ambos como registro de cliente. El token se despacha seg\u00fan el grant_type en el cuerpo de la solicitud, por lo que un cliente registrado solo para authorization_code puede solicitar client_credentials, y esa rama pasa el \u00e1mbito solicitado directamente al emisor, que lo firma en el token de acceso at+jwt. Authorize copia el \u00e1mbito de la consulta en el registro del c\u00f3digo de autorizaci\u00f3n sin compararlo con el registro, dejando el punto de enganche de consentimiento opcional como la \u00fanica verificaci\u00f3n entre un \u00e1mbito arbitrario y el c\u00f3digo emitido. Las redirect_uris en la misma fila del cliente se leen y se aplican.\n\nUn cliente registrado puede obtener un token correctamente firmado que lleva cualquier \u00e1mbito que nombre, y un servidor de recursos que ejecuta Punk::OAuth2::Checker acepta ese token y respeta el \u00e1mbito. Un cliente registrado sin un secreto se autentica solo con su client_id, por lo que cualquiera que conozca ese identificador puede solicitar uno."
          }
        ],
        "id": "CVE-2026-75866",
        "lastModified": "2026-10-15T19:10:00.173",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-75866",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T19:29:05.610651Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-22T14:16:33.700",
        "references": [
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://datatracker.ietf.org/doc/html/rfc6749#section-3.3"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://datatracker.ietf.org/doc/html/rfc6749#section-5.2"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://metacpan.org/release/LNATION/Punk-OAuth2-0.03/view/lib/Punk/OAuth2/Server/Store.pm"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://metacpan.org/release/LNATION/Punk-OAuth2-0.04/changes"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openwall.com/lists/oss-security/2026/08/22/6"
          }
        ],
        "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-08-22T19:07:08.861Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2026/08/22/6"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 9.1,
                  "baseSeverity": "CRITICAL",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-75866",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-25T19:29:05.610651Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-25T19:29:19.515Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://cpan.org/modules",
              "defaultStatus": "unaffected",
              "modules": [
                "Punk::OAuth2::Server"
              ],
              "packageName": "Punk-OAuth2",
              "packageURL": "pkg:cpan/Punk-OAuth2",
              "programFiles": [
                "include/pox/pox_server.h"
              ],
              "programRoutines": [
                {
                  "name": "Punk::OAuth2::Server::token"
                },
                {
                  "name": "Punk::OAuth2::Server::authorize"
                }
              ],
              "versions": [
                {
                  "lessThanOrEqual": "0.03",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client\u0027s registered scopes and grant types because no authorization path reads them.\n\nPunk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token dispatches on the grant_type in the request body, so a client registered for authorization_code alone can ask for client_credentials, and that arm passes the requested scope straight to the minter, which signs it into the at+jwt access token. authorize copies the query scope into the authorization code record without comparing it against the registration, leaving the optional consent hook as the only check between an arbitrary scope and the issued code. redirect_uris on the same client row is read and enforced.\n\nA registered client can obtain a correctly signed token carrying any scope it names, and a resource server running Punk::OAuth2::Checker accepts that token and honours the scope. A client registered without a secret authenticates on its client_id alone, so anyone who knows that identifier can request one."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-22T13:52:49.922Z",
            "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "shortName": "CPANSec"
          },
          "references": [
            {
              "tags": [
                "release-notes"
              ],
              "url": "https://metacpan.org/release/LNATION/Punk-OAuth2-0.04/changes"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://metacpan.org/release/LNATION/Punk-OAuth2-0.03/view/lib/Punk/OAuth2/Server/Store.pm"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://datatracker.ietf.org/doc/html/rfc6749#section-3.3"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://datatracker.ietf.org/doc/html/rfc6749#section-5.2"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to Punk-OAuth2 0.04 or later."
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client\u0027s registered scopes and grant types because no authorization path reads them",
          "workarounds": [
            {
              "lang": "en",
              "value": "In a proxy ahead of Punk::OAuth2::Server, reject a token or authorization request that asks for a grant type or scope the client is not registered for."
            }
          ],
          "x_generator": {
            "engine": "cpansec-cna-tool 0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "assignerShortName": "CPANSec",
        "cveId": "CVE-2026-75866",
        "datePublished": "2026-08-22T13:52:49.922Z",
        "dateReserved": "2026-08-18T11:17:09.339Z",
        "dateUpdated": "2026-08-25T19:29:36.357Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.