Punk::OAuth2::Server EUVD-2026-64293

Exploitation requires that the target run Punk::OAuth2::Server (through 0.03) as its authorization server with a resource server trusting its at+jwt tokens (e.g., via Punk::OAuth2::Checker). The attacker must be able to reach the token endpoint and possess a valid registered client_id; for confidential clients this means a registered client secret, but for clients registered WITHOUT a secret the client_id alone suffices, so anyone who knows that identifier qualifies. The attacker then simply names a grant_type or scope beyond the client's registration - the concrete precondition is that the client-supplied grant_type/scope in the token or authorize request is not compared against the stored registration. The main limiting factors are the small deployment base of this module, the need for a valid client_id on the specific server, and the fact that an operator who has made the consent hook mandatory and scope-validating is not exploitable.

The signals are mixed but lean toward a genuine authorization-integrity priority rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H) rates it 9.1 Critical, and the flaw is deterministic and trivial to trigger - no memory corruption, race, or special timing. However, EPSS is only 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code was identified, so widespread opportunistic exploitation is not indicated. The PR:N rating is defensible only for public (secretless) clients that authenticate on client_id alone, which is not a secret; confidential clients still need valid registration, so real-world exploitation presupposes access to a registered client_id on a deployment actually using this module. The most important limiter is deployment footprint: Punk::OAuth2 is an obscure CPAN package, so the population of exposed targets is small. Any operator who has embedded this library in a production authorization server should treat it as urgent regardless of size, because a signed over-scoped token silently defeats the resource server's access controls; the low EPSS reflects rarity of the product, not safety of the flaw.

An attacker who knows the client_id of a public (secretless) client registered on a Punk::OAuth2::Server deployment sends a token request to the client_credentials arm naming a high-privilege scope the client was never granted; the server signs an at+jwt token carrying that scope, and the attacker presents it to a Punk::OAuth2::Checker resource server, which honours the scope and grants the corresponding access. No public exploit code is currently identified, but the network-reachable, low-complexity vector (AV:N/AC:L) makes crafting one straightforward.