CVE-2026-75628
Received Received - Intake

Open Redirect in Punk::OAuth2 for Perl

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: CPANSec

Description
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter. oauth2_login reads the return parameter from the initiation request, runs same_origin_path over it, and stores the survivor in the session flow record as the post-login redirect target. That check rejects a value that does not begin with a slash, one with a slash as its second byte, and one containing CR or LF. A backslash and a tab pass. The URL Standard treats a backslash as equivalent to a slash for special schemes, so `/\evil.example` parses with the authority `evil.example`. It also strips ASCII tab before parsing, so a tab between two leading slashes leaves `//evil.example`. A crafted link to the application's own login route lands the victim on the attacker's site after a genuine authentication. The redirect carries no authorization code or access token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-75628
EUVD
EUVD-2026-63189

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
punk oauth2 to 0.03 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Punk::OAuth2 versions before 0.03 for Perl have a vulnerability where an attacker can manipulate the redirect URL after login. The same_origin_path function incorrectly accepts backslashes or tabs in the return parameter, allowing an off-site redirect to an attacker-controlled domain. This happens because the URL Standard treats backslashes as equivalent to slashes, enabling malicious redirects like /\evil.example or //evil.example.

Detection Guidance

Check Perl applications using Punk::OAuth2 versions before 0.03 for unusual redirect behavior after login. Inspect server logs for authentication flows with backslash, tab, or malformed return parameters in URLs. Validate if same_origin_path incorrectly accepts these characters.

Impact Analysis

This vulnerability could allow an attacker to trick users into visiting a malicious site after a legitimate login. The redirect carries no authorization tokens, but it could be used for phishing, session hijacking, or stealing sensitive data. Users might unknowingly provide credentials or personal information to the attacker's site.

Compliance Impact

This vulnerability violates OAuth 2.0 security best practices outlined in RFC 9700, which emphasizes strict redirect URI validation to prevent open redirectors. Non-compliance with such standards could lead to regulatory penalties under GDPR (data protection) or HIPAA (healthcare privacy) if user data is exposed due to the redirect attack.

Mitigation Strategies

Upgrade Punk::OAuth2 to version 0.03 or later. Implement strict redirect URI validation to reject backslashes, tabs, and CR/LF characters. Follow RFC 9700 guidelines for OAuth 2.0 security, including PKCE and nonce validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart