CVE-2026-75870: Punk for Perl Auth Bypass Vulnerability

CVE-2026-75870 Overview

CVE-2026-75870 affects Punk versions before 0.18 for Perl. The framework allows session cookie forgery through an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given and does not require a secret, warn, or refuse to start when one is absent.

Cookie read and write-back operations both default the signing key to the empty string. A declaration with no secret option, or with an undefined or empty one, signs and verifies cookies using a zero-length HMAC-SHA256 key. The flaw is categorized under CWE-1394: Use of Default Cryptographic Key.

Critical Impact
An attacker who knows the cookie format can mint session cookies offline containing arbitrary contents, including user identifiers and role claims, enabling authentication bypass and privilege escalation.

Affected Products

Punk for Perl versions prior to 0.18
Perl web applications using the Punk session keyword without an explicit secret
Deployments relying on Punk defaults for session cookie signing

Discovery Timeline

2026-08-22 - CVE-2026-75870 published to NVD and disclosed on the OpenWall oss-security mailing list
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75870

Vulnerability Analysis

Punk's session mechanism issues signed cookies to preserve state between requests. The framework uses HMAC-SHA256 to sign the cookie payload, and the signing key is supposed to be supplied by the application through a secret option on the session declaration.

When the developer omits the option, or passes an undefined or empty value, Punk does not raise an error or emit a warning. Instead, both the write path that mints new cookies and the read path that verifies incoming cookies fall back to an empty string as the HMAC key. Every signature is then computed with a zero-length key that any external party can reproduce.

The misconfiguration produces no runtime indicators. Cookies are well-formed, sessions round-trip normally, and the application behaves as expected until an attacker begins forging cookies.

Root Cause

The root cause is insecure-by-default cryptographic configuration. Punk treats the secret option as optional and silently substitutes an empty string when the application does not provide one. Because HMAC-SHA256 accepts keys of any length, including zero, no cryptographic error surfaces to signal the missing secret.

Attack Vector

Exploitation requires only network access to the target application and knowledge of the Punk cookie format, which is available from the public source in the Punk 0.17 session header and the Punk.pm module.

An attacker constructs a session payload containing chosen fields such as user_id or role, computes HMAC-SHA256 over that payload with an empty key, and submits the resulting cookie to the application. The server verifies the signature with the same empty key, accepts the payload as authentic, and grants the impersonated session. No prior authentication, user interaction, or elevated privilege is required.

Refer to the Punk 0.18 Changes file and the OpenWall oss-security discussion for additional technical context. No verified public exploit code has been published.

Detection Methods for CVE-2026-75870

Indicators of Compromise

Session cookies containing valid signatures for privileged accounts that were never authenticated through the login flow
Application logs showing authenticated actions with no preceding login event for the associated user or role
Unexpected role escalation or user_id changes between requests within a single client session

Detection Strategies

Audit Punk applications for session declarations that omit the secret option or set it to an empty or undefined value
Static-analyze deployed Perl code and configuration for missing session secrets before runtime
Correlate authentication events with session issuance to identify sessions that appear without a corresponding login

Monitoring Recommendations

Log the source IP, user agent, and account for every session validation and flag validations that lack an antecedent authentication
Alert on rapid privilege changes within a session or on session cookies bearing administrative roles from previously unseen clients
Track deployments of Perl applications and confirm the installed Punk version is 0.18 or later

How to Mitigate CVE-2026-75870

Immediate Actions Required

Upgrade Punk to version 0.18 or later on all Perl application hosts
Configure an explicit, high-entropy secret on every session declaration and reject deployment if the value is missing or empty
Invalidate all existing session cookies after upgrade and force re-authentication for every user
Review recent administrative actions for evidence of forged-session activity

Patch Information

Upgrade to Punk 0.18, which addresses the empty-key fallback behavior. See the Punk 0.18 Changes file for the fix details and the OpenWall oss-security discussion for background.

Workarounds

Wrap the session declaration in application startup code that raises a fatal error if the secret option is missing, undefined, or empty
Rotate the session secret to a cryptographically random value of at least 32 bytes and store it outside the code repository
Terminate active sessions and require re-authentication whenever the secret is rotated

bash

# Configuration example
# Enforce an explicit session secret on Punk applications
export PUNK_SESSION_SECRET="$(openssl rand -hex 32)"
cpanm Punk@0.18