CVE-2026-75628: Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter.
oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in the session flow record as the post-login redirect target. That check rejects a value that does not begin with a slash, one with a slash as its second byte, and one containing CR or LF. A backslash and a tab pass. The URL Standard treats a backslash as equivalent to a slash for special schemes, so /\evil.example parses with the authority evil.example. It also strips ASCII tab before parsing, so a tab between two leading slashes leaves //evil.example.
A crafted link to the application's own login route lands the victim on the attacker's site after a genuine authentication. The redirect carries no authorization code or access token.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Punk::OAuth2 (Perl)to a version that resolves this vulnerability.Fixed in 0.03 - Compensating control
If immediate upgrade is not possible, ensure the post-login redirect target is restricted to same-origin paths (disallow backslash or tab in the return parameter; reject values that do not begin with a slash or that contain CR or LF) before storing/using it in the session flow record.
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Punk::OAuth2 for Perl at versions before 0.03 are affected. Version 0.03 is not included in the affected version range.
What does an attacker need to exploit this?
The attacker needs to get a victim to follow a crafted link to the application's own OAuth2 login route with a malicious return parameter. After the victim completes genuine authentication, the application redirects the victim to the attacker-controlled site.
Are authorization codes or access tokens exposed by the redirect?
No. The described redirect does not carry an authorization code or access token.
What input patterns trigger the unsafe redirect behavior?
A return value beginning with a slash followed by a backslash can be interpreted as an off-site URL, such as /\evil.example. A tab placed between two leading slashes can also be stripped during URL parsing, leaving an off-site //evil.example URL.