LNATION Punk::OAuth2 up to 0.02 same_origin_path oauth2_login return redirect

Summaryinfo

A vulnerability classified as problematic was found in LNATION Punk::OAuth2 up to 0.02. Impacted is the function oauth2_login of the component same_origin_path. Such manipulation of the argument return leads to redirect. This vulnerability is documented as CVE-2026-75628. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in LNATION Punk::OAuth2 up to 0.02. It has been rated as problematic. Affected by this issue is the function oauth2_login of the component same_origin_path. The manipulation of the argument return with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. CVE summarizes:

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter. oauth2_login reads the return parameter from the initiation request, runs same_origin_path over it, and stores the survivor in the session flow record as the post-login redirect target. That check rejects a value that does not begin with a slash, one with a slash as its second byte, and one containing CR or LF. A backslash and a tab pass. The URL Standard treats a backslash as equivalent to a slash for special schemes, so `/\evil.example` parses with the authority `evil.example`. It also strips ASCII tab before parsing, so a tab between two leading slashes leaves `//evil.example`. A crafted link to the application's own login route lands the victim on the attacker's site after a genuine authentication. The redirect carries no authorization code or access token.

The advisory is shared for download at metacpan.org. This vulnerability is handled as CVE-2026-75628 since 08/18/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1204.001.

Upgrading to version 0.03 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-63189). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• LNATION

Name

• Punk::OAuth2

Version

• 0.02

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion