EUVD-2026-64294
GHSA-3679-xr9w-9625
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote unauthenticated cookie forgery enables full session impersonation (C:H/I:H) with no availability impact; the missing-secret misconfiguration is the framework default, so AC stays low and PR:N.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.
The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key.
An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.
AnalysisAI
Session cookie forgery in Punk before 0.18 (a Perl web framework by LNATION) lets remote unauthenticated attackers mint valid session cookies whenever an application declares a session without a secret. Because the cookie reader and write-back both default the HMAC-SHA256 key to an empty string, cookies are signed and verified with a zero-length key, so anyone who knows the cookie format can offline-forge a session carrying any user identifier or role. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to declare a Punk session with no secret option, or with a secret that is undefined or an empty string - that misconfiguration is the exact prerequisite, and it is the framework's unguarded default behavior rather than an intentional setting. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) reflects trivially forgeable authentication with high confidentiality and integrity impact and no availability impact - an accurate picture for an affected deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has observed or reverse-engineered Punk's cookie format targets a site running Punk < 0.18 that declared its session without a secret. Offline, the attacker constructs a session payload setting their user identifier to an administrator and computes a valid HMAC-SHA256 tag using the empty key, then presents the forged cookie to obtain an authenticated privileged session. … |
| Remediation | Upgrade to Punk 0.18, which per the release Changes (https://metacpan.org/release/LNATION/Punk-0.18/source/Changes) addresses the empty-default-key behavior; treat this as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Punk framework by version and determine which applications use session management without explicit secret configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-1394 – Use of Default Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today