CVE-2026-75866 Overview
CVE-2026-75866 is a broken authorization flaw in Punk::OAuth2::Server versions through 0.03 for Perl. The server issues access tokens outside a client's registered scopes and grant types because no authorization path validates them against the client registration. A registered client can request any scope through the client_credentials grant, and the server signs it into an at+jwt access token that resource servers running Punk::OAuth2::Checker will accept. Clients registered without a secret authenticate on client_id alone, so any party that learns the identifier can obtain a token. The issue is tracked under CWE-862: Missing Authorization.
Critical Impact
Any registered client, including secretless clients identified only by client_id, can mint correctly signed OAuth2 access tokens carrying arbitrary scopes and grant types, bypassing per-client scope and grant restrictions.
Affected Products
- Punk::OAuth2::Server for Perl, versions through 0.03
- Punk::OAuth2::Server::Store client registration component
- Punk::OAuth2::Checker resource server token validator
Discovery Timeline
- 2026-08-22 - CVE-2026-75866 published to NVD
- 2026-08-22 - Public discussion posted to the Openwall OSS-Security list
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-75866
Vulnerability Analysis
The vulnerability breaks two core OAuth2 authorization guarantees defined in RFC 6749 Section 3.3 and RFC 6749 Section 5.2. Punk::OAuth2::Server::Store records both scopes and grant_types per client at registration, but the token endpoint never enforces either constraint. The token handler dispatches purely on the grant_type value supplied in the request body. A client registered for authorization_code alone can therefore submit a client_credentials request, and the server proceeds without checking the registered grant list.
On that path, the requested scope parameter is passed straight to the token minter. The minter signs the caller-controlled scope into an at+jwt access token, which resource servers running Punk::OAuth2::Checker accept as authoritative. The authorize endpoint has a similar defect: it copies the query scope into the authorization code record without comparing it against the client registration, leaving the optional consent hook as the only barrier.
Root Cause
The root cause is missing authorization logic on the token and authorize paths. redirect_uris is read from the same client row and enforced correctly, but the parallel scopes and grant_types fields are never consulted. No code path compares the request against the stored registration before signing the token.
Attack Vector
Exploitation requires network access to the OAuth2 authorization server and knowledge of a valid client_id. For clients registered without a secret, this identifier is the only credential needed. The attacker sends a client_credentials request naming any scope, including scopes reserved for other clients or privileged resource servers. The returned at+jwt is a valid, signed token that downstream resource servers will honor. See the MetaCPAN Punk-OAuth2 Store source for the affected code paths.
Detection Methods for CVE-2026-75866
Indicators of Compromise
- Access tokens issued via client_credentials for client_id values registered only with authorization_code or other grants.
- at+jwt tokens containing scopes that do not appear in the issuing client's registered scopes list.
- Successful /token responses for secretless clients originating from unfamiliar source IP addresses.
- Resource server access logs showing privileged scope usage by clients that historically requested narrower scopes.
Detection Strategies
- Correlate issued token scopes and grant_type claims against the Punk::OAuth2::Server::Store client registration table to flag mismatches.
- Inspect authorization code records for scope values not present in the client's registered scope set.
- Alert on /token requests where the submitted grant_type differs from any grant type recorded for the client.
Monitoring Recommendations
- Enable verbose logging on the token and authorize handlers to capture requested versus registered scopes and grant types.
- Forward OAuth2 server logs and resource server decisions to a centralized analytics pipeline for cross-source correlation.
- Baseline scope usage per client_id and alert on statistical outliers, especially first-seen scope claims.
How to Mitigate CVE-2026-75866
Immediate Actions Required
- Upgrade Punk::OAuth2 to version 0.04 or later, which contains the fixes described in the Punk-OAuth2 Changes file.
- Rotate client_id values and issue client secrets for any clients previously registered without a secret.
- Revoke outstanding at+jwt access tokens and require reissuance under the patched server.
- Audit resource server logs for prior token acceptance events involving scopes outside the issuing client's registration.
Patch Information
Upgrade to Punk::OAuth2 version 0.04 from CPAN. Review the release changes file to confirm the scope and grant-type enforcement fixes are present before returning the service to production.
Workarounds
- Require a client secret for every registered client and reject requests that authenticate on client_id alone.
- Add an application-layer proxy in front of the /token endpoint that validates grant_type and scope against the client registration.
- Restrict resource servers using Punk::OAuth2::Checker to a narrow allow-list of scopes until the upgrade is deployed.
- Disable the client_credentials grant on the server if it is not required by any registered client.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
