OAuth 2.0 Token Mismanagement in Punk::OAuth2::Server by LNATION
CVE-2026-75866
What is CVE-2026-75866?
The Punk::OAuth2::Server for Perl versions up to 0.03 exhibits a vulnerability that allows unauthorized access tokens to be issued outside the client's registered authorization scopes and grant types. This issue arises because the authorization mechanism fails to properly validate scopes against those registered during the client registration process. As a result, clients can deceptively request tokens with scopes beyond their permitted limits, potentially leading to unauthorized access to sensitive resources. The absence of adequate checks means that even a client without a client secret could exploit this flaw simply by knowing the client ID. This vulnerability poses a significant risk where any registered client could obtain access tokens with arbitrary scopes, raising serious security concerns.