CVE-2026-75866

{"id": "CVE-2026-75866", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75866", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-25T19:29:05.610651Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"modules": ["Punk::OAuth2::Server"], "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.03"}], "packageURL": "pkg:cpan/Punk-OAuth2", "packageName": "Punk-OAuth2", "programFiles": ["include/pox/pox_server.h"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Punk::OAuth2::Server::token"}, {"name": "Punk::OAuth2::Server::authorize"}]}]}], "published": "2026-08-22T14:16:33.700", "references": [{"url": "https://datatracker.ietf.org/doc/html/rfc6749#section-3.3", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://datatracker.ietf.org/doc/html/rfc6749#section-5.2", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/LNATION/Punk-OAuth2-0.03/view/lib/Punk/OAuth2/Server/Store.pm", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/LNATION/Punk-OAuth2-0.04/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/22/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them.\n\nPunk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token dispatches on the grant_type in the request body, so a client registered for authorization_code alone can ask for client_credentials, and that arm passes the requested scope straight to the minter, which signs it into the at+jwt access token. authorize copies the query scope into the authorization code record without comparing it against the registration, leaving the optional consent hook as the only check between an arbitrary scope and the issued code. redirect_uris on the same client row is read and enforced.\n\nA registered client can obtain a correctly signed token carrying any scope it names, and a resource server running Punk::OAuth2::Checker accepts that token and honours the scope. A client registered without a secret authenticates on its client_id alone, so anyone who knows that identifier can request one."}, {"lang": "es", "value": "Las versiones de Punk::OAuth2::Server hasta la 0.03 para Perl emiten tokens de acceso fuera de los \u00e1mbitos y tipos de concesi\u00f3n registrados de un cliente porque ninguna ruta de autorizaci\u00f3n los lee.\n\nPunk::OAuth2::Server::Store registra \u00e1mbitos y grant_types por cliente y documenta ambos como registro de cliente. El token se despacha seg\u00fan el grant_type en el cuerpo de la solicitud, por lo que un cliente registrado solo para authorization_code puede solicitar client_credentials, y esa rama pasa el \u00e1mbito solicitado directamente al emisor, que lo firma en el token de acceso at+jwt. Authorize copia el \u00e1mbito de la consulta en el registro del c\u00f3digo de autorizaci\u00f3n sin compararlo con el registro, dejando el punto de enganche de consentimiento opcional como la \u00fanica verificaci\u00f3n entre un \u00e1mbito arbitrario y el c\u00f3digo emitido. Las redirect_uris en la misma fila del cliente se leen y se aplican.\n\nUn cliente registrado puede obtener un token correctamente firmado que lleva cualquier \u00e1mbito que nombre, y un servidor de recursos que ejecuta Punk::OAuth2::Checker acepta ese token y respeta el \u00e1mbito. Un cliente registrado sin un secreto se autentica solo con su client_id, por lo que cualquiera que conozca ese identificador puede solicitar uno."}], "lastModified": "2026-10-15T19:10:00.173", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}