CVE-2026-75628 Overview
CVE-2026-75628 is an open redirect vulnerability in Punk::OAuth2 for Perl, affecting all versions before 0.03. The flaw resides in the same_origin_path validation routine, which fails to reject backslash and tab characters in the return parameter. An attacker can craft a link to the application's legitimate login route that redirects the victim to an attacker-controlled site after successful authentication. The vulnerability is classified as [CWE-601] URL Redirection to Untrusted Site (Open Redirect).
Critical Impact
A crafted login link redirects authenticated users to attacker-controlled infrastructure, enabling phishing, credential harvesting, and social engineering attacks that appear to originate from a trusted domain.
Affected Products
- Punk::OAuth2 for Perl versions prior to 0.03
- Perl applications using oauth2_login with the vulnerable same_origin_path check
- Web applications relying on Punk::OAuth2 for OAuth 2.0 flow handling
Discovery Timeline
- 2026-08-20 - CVE CVE-2026-75628 published to NVD
- 2026-08-20 - Disclosure posted to the OpenWall OSS Security mailing list
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75628
Vulnerability Analysis
The oauth2_login handler in Punk::OAuth2 reads the return parameter from the initiation request and passes it through same_origin_path. The surviving value is stored in the session flow record as the post-login redirect target. The validation logic rejects values that do not begin with a slash, values with a slash as the second byte, and values containing carriage return (CR) or line feed (LF) characters.
The check does not reject backslash (\) or tab (\t) characters. This gap conflicts with modern URL parsing rules defined by the WHATWG URL Standard. For special schemes such as HTTP and HTTPS, the URL parser treats a backslash as equivalent to a forward slash. The parser also strips ASCII tab characters before parsing begins.
As a result, a return value of /\evil.example parses with the authority evil.example. A return value containing a tab between two leading slashes (/\t/evil.example) reduces to //evil.example, which browsers interpret as a protocol-relative URL to the attacker's host. The redirect carries no authorization code or access token, but it delivers a freshly authenticated victim to attacker infrastructure.
Root Cause
The root cause is a mismatch between the allowlist logic in same_origin_path and the parsing behavior of browsers implementing the WHATWG URL Standard. The Perl-side check treats input as a byte string and does not normalize backslash-to-slash conversions or strip tab characters. Browsers perform both transformations before evaluating the origin.
Attack Vector
An attacker constructs a URL pointing to the victim application's own login initiation route with a malicious return parameter, for example https://victim.example/login?return=/\evil.example. The victim clicks the link, authenticates normally through the legitimate OAuth flow, and is then redirected to https://evil.example. Because authentication succeeds on the trusted domain, users are unlikely to notice the destination change. The attacker's landing page can then impersonate the application to harvest additional credentials, prompt for multi-factor authentication codes, or deliver malware.
Refer to the MetaCPAN Source File Reference for the vulnerable code and the WHATWG Relative Slash State specification for the parser behavior that enables the bypass.
Detection Methods for CVE-2026-75628
Indicators of Compromise
- HTTP request logs containing a return query parameter with backslash characters (\ or URL-encoded %5C) targeting the login initiation route.
- HTTP request logs showing a return parameter with embedded ASCII tab characters (%09) between leading slashes.
- Post-login 302 redirect responses whose Location header points to a host outside the application's registered origin.
Detection Strategies
- Parse web server access logs for requests to the OAuth login route where the return parameter contains %5C, %09, or literal backslash and tab bytes.
- Correlate authentication success events with subsequent off-origin redirects issued by the application within the same session.
- Deploy web application firewall rules that decode and canonicalize the return parameter before applying origin checks.
Monitoring Recommendations
- Alert on outbound Referer traffic from authenticated sessions to newly registered or low-reputation domains.
- Track the distribution of return parameter values over time and investigate anomalous character patterns.
- Review Punk::OAuth2 dependency versions in Perl application manifests during routine software composition analysis scans.
How to Mitigate CVE-2026-75628
Immediate Actions Required
- Upgrade Punk::OAuth2 to version 0.03 or later, which corrects the same_origin_path validation. See the MetaCPAN Release Changes for details.
- Audit application logs for prior use of malicious return parameter values and notify affected users if patterns of abuse are found.
- Enforce an allowlist of exact post-login redirect targets rather than accepting arbitrary paths from user input.
Patch Information
The fix is available in Punk::OAuth2 version 0.03 on CPAN. The maintainer updated the same_origin_path routine to reject backslash and tab characters in addition to the existing checks for CR and LF. Consult the IETF RFC 9700 Section 4.11.1 guidance on OAuth 2.0 redirect handling for defense-in-depth recommendations.
Workarounds
- If patching is not immediately feasible, add server-side validation that rejects any return parameter containing \, %5C, \t, or %09 before the value reaches same_origin_path.
- Configure the application to ignore the return parameter entirely and always redirect authenticated users to a fixed, hardcoded landing URL.
- Deploy a reverse proxy rule that strips or rewrites suspicious characters in the return parameter of requests to the OAuth login route.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
