CVE-2026-75870: Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret

Published Aug 22, 2026
·
Updated

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.

The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key.

An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.

Affected Software

1 affected component
Punk Perl<0.18

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Perl Punk to a version that resolves this vulnerability.

    Fixed in 0.18Patch CVE-2026-75870

Event History

Aug 22, 2026
CVE Published
via MITRE·01:35 PM
Data Sourced
via MITRE·01:35 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·02:16 PM
DescriptionWeakness

Frequently Asked Questions

1

Which applications are exposed to session forgery?

Applications using affected Punk versions are exposed when they declare a session without a secret, or provide an undefined or empty secret. Sessions configured with a non-empty secret are not described as affected.

2

What does an attacker need to forge a session cookie?

The attacker needs to know the cookie format. Because the affected configuration uses an empty HMAC-SHA256 key, they can create a valid cookie offline with arbitrary session contents, such as a user identifier or role.

3

Will the application show errors or warnings if it is vulnerable?

No. The session declaration does not require a secret, warn, or refuse startup when one is absent, and forged-cookie-prone sessions continue to produce well-formed cookies and round-trip normally.

4

How can I determine whether an application is affected?

Review every session declaration and its resolved secret value. A declaration with no secret option, or with an undefined or empty secret, is affected in Punk versions before 0.18.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203