EUVD-2026-64294
GHSA-3679-xr9w-9625
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Punk < 0.18
-
DeliveryDetermine session cookie format
-
ExploitForge cookie signed with empty HMAC key
-
ExecutionSet attacker-chosen user ID or role
-
ImpactSubmit forged cookie to impersonate account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism
|
| Exploitation Conditions | Exploitation requires the target application to declare a Punk session with no secret option, or with a secret that is undefined or an empty string - that misconfiguration is the exact prerequisite, and it is the framework's unguarded default behavior rather than an intentional setting. The attacker must also know or derive the cookie serialization format to construct a well-formed forgery. Limiting factors: applications that explicitly set a non-empty session secret are not affected, and the vulnerability is confined to Punk versions before 0.18; there is no user interaction or prior authentication needed, and because no runtime warning is emitted, operators may be unaware they are in the vulnerable state. |
| Impact | The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) reflects trivially forgeable authentication with high confidentiality and integrity impact and no availability impact - an accurate picture for an affected deployment. The important nuance is that exploitability is gated entirely on a deployment condition: the session must be declared with no (or empty/undefined) secret, and nothing flags this at runtime since cookies remain well formed and sessions round-trip normally. This split explains the tension in the signals: EPSS is low (0.20%, 10th percentile) and there is no KEV listing or known public POC, suggesting the raw base score overstates fleet-wide urgency, yet for any site that actually shipped without a secret the practical risk of full account/role impersonation is severe and should be remediated promptly. There is a data gap worth flagging - the CVSS marks AV:N/AC:L/PR:N as if universally exploitable, but the description makes clear a misconfiguration prerequisite exists, so the effective population at risk is narrower than the 9.1 implies. |
| Exploit ScenarioDerived | An attacker who has observed or reverse-engineered Punk's cookie format targets a site running Punk < 0.18 that declared its session without a secret. Offline, the attacker constructs a session payload setting their user identifier to an administrator and computes a valid HMAC-SHA256 tag using the empty key, then presents the forged cookie to obtain an authenticated privileged session. No public exploit code is known, but the technique requires only knowledge of the cookie structure and no interaction with a victim. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Session cookie forgery in Punk before 0.18 (a Perl web framework by LNATION) lets remote unauthenticated attackers mint valid session cookies whenever an application declares a session without a secret. Because the cookie reader and write-back both default the HMAC-SHA256 key to an empty string, cookies are signed and verified with a zero-length key, so anyone who knows the cookie format can offline-forge a session carrying any user identifier or role. No public exploit has been identified at time of analysis, and EPSS is low (0.20%, 10th percentile), but the CVSS base score is 9.1 and exploitation is trivial once the misconfiguration exists.
RemediationAI
Upgrade to Punk 0.18, which per the release Changes (https://metacpan.org/release/LNATION/Punk-0.18/source/Changes) addresses the empty-default-key behavior; treat this as the primary fix. Independent of upgrading, every application must explicitly set a strong, high-entropy session secret in the session declaration - do not rely on the default - and rotate/invalidate existing sessions after doing so, since any cookies issued under the empty key must be considered forgeable and should be discarded (side effect: all users are logged out). As a detective control until patched, audit application startup configuration to confirm no session is declared with a missing, undefined, or empty secret, because the framework emits no runtime warning for this state. Advisory context: https://seclists.org/oss-sec/2026/q3/548 and https://vuldb.com/vuln/394331.
Affected ProductsAI
Punk for Perl, all versions before 0.18 (the LNATION CPAN distribution). Source references point to Punk-0.17 (lib/Punk.pm and include/punk/punk_session.h) as vulnerable and the Punk-0.18 Changes file as the fixed release. No CPE string was provided in the intelligence. Advisory and detail links: https://nvd.nist.gov/vuln/detail/CVE-2026-75870, https://seclists.org/oss-sec/2026/q3/548, and https://vuldb.com/vuln/394331 (ENISA EUVD-2026-64294).
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Punk is a Perl web framework distributed on CPAN (module Punk.pm with a C helper, punk_session.h). The flaw is classified as CWE-1394 (Use of Default Cryptographic Key): the session keyword freezes its options onto the application exactly as provided and does not require, warn about, or refuse to start on a missing secret. Both the cookie-read path and the cookie write-back default the signing key to the empty string, so when the secret option is absent, undefined, or empty, the framework performs HMAC-SHA256 with a zero-length key. HMAC with a known (empty) key provides no unforgeability, allowing anyone to recompute a valid signature over attacker-chosen session contents.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote unauthenticated cookie forgery enables full session impersonation (C:H/I:H) with no availability impact; the missing-secret misconfiguration is the framework default, so AC stays low and PR:N.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.
The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key.
An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.
Executive ViewAI
The Punk web framework (versions prior to 0.18) contains a critical session authentication bypass allowing unauthenticated attackers to forge session cookies and assume any user identity, including administrative accounts. Organizations running Punk-based applications with default session configurations face immediate risk of complete account compromise. The flaw stems from the framework's insecure default of signing and verifying sessions with an empty cryptographic key, making forged sessions trivial to create and detect.
No vendor-released patch identified at time of analysis. Implement these interim mitigations: (1) mandate explicit session secret configuration in all Punk applications with strong random values; (2) eliminate reliance on framework defaults through code review and automated verification; (3) implement session anomaly detection to identify potential session hijacking; (4) restrict session cookie attributes (Secure, HttpOnly, SameSite flags); (5) maintain detailed access logs for forensic investigation if compromise occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB