CVE-2026-75870
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the Punk library for Perl before version 0.18, there is a session cookie forgery vulnerability. When a session is declared without a secret, the default HMAC key is empty, allowing an attacker to mint cookies with arbitrary contents such as user ID or role.
Risk Assessment
An attacker can impersonate any user, potentially leading to unauthorized access to accounts and session integrity compromise.
Recommendation
Update the Punk library to version 0.18 or later. Ensure all sessions are declared with an explicit, strong secret.
Original NVD description (English source)
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key. An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.