CVE-2026-75866
Received Received - Intake

Authorization Bypass in Punk::OAuth2::Server

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: CPANSec

Description
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token dispatches on the grant_type in the request body, so a client registered for authorization_code alone can ask for client_credentials, and that arm passes the requested scope straight to the minter, which signs it into the at+jwt access token. authorize copies the query scope into the authorization code record without comparing it against the registration, leaving the optional consent hook as the only check between an arbitrary scope and the issued code. redirect_uris on the same client row is read and enforced. A registered client can obtain a correctly signed token carrying any scope it names, and a resource server running Punk::OAuth2::Checker accepts that token and honours the scope. A client registered without a secret authenticates on its client_id alone, so anyone who knows that identifier can request one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-75866
EUVD
EUVD-2026-64293

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
punk oauth2 server
punk oauth2 checker

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Punk::OAuth2::Server versions up to 0.03 for Perl. It allows clients to request access tokens with scopes outside their registered permissions. The issue occurs because token generation does not validate requested scopes against client registration, enabling unauthorized scope requests. Clients can also bypass authentication if registered without a secret.

Detection Guidance

Check OAuth2 token issuance logs for clients requesting scopes or grant types outside their registered permissions. Inspect authorization codes for arbitrary scopes before token minting. Verify client authentication mechanisms for clients without secrets.

Impact Analysis

An attacker could exploit this to gain elevated access by requesting tokens with unauthorized scopes. If a client ID is known, even without a secret, an attacker can request tokens. Resource servers using Punk::OAuth2::Checker will honor these tokens, potentially exposing sensitive data or performing unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating principles of least privilege and data protection. GDPR requires strict access controls and user consent, while HIPAA mandates safeguards for protected health information. Exploitation may result in non-compliance, legal penalties, and loss of trust due to unauthorized data exposure.

Mitigation Strategies

Update Punk::OAuth2::Server to a version that validates scopes and grant types against client registrations. Review client configurations to ensure scopes and grant types are properly restricted. Monitor tokens for unauthorized scopes and revoke suspicious tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75866. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart