CVE-2026-75870: Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.
The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key.
An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl Punkto a version that resolves this vulnerability.Fixed in 0.18Patch CVE-2026-75870
Event History
Frequently Asked Questions
Which applications are exposed to session forgery?
Applications using affected Punk versions are exposed when they declare a session without a secret, or provide an undefined or empty secret. Sessions configured with a non-empty secret are not described as affected.
What does an attacker need to forge a session cookie?
The attacker needs to know the cookie format. Because the affected configuration uses an empty HMAC-SHA256 key, they can create a valid cookie offline with arbitrary session contents, such as a user identifier or role.
Will the application show errors or warnings if it is vulnerable?
No. The session declaration does not require a secret, warn, or refuse startup when one is absent, and forged-cookie-prone sessions continue to produce well-formed cookies and round-trip normally.
How can I determine whether an application is affected?
Review every session declaration and its resolved secret value. A declaration with no secret option, or with an undefined or empty secret, is affected in Punk versions before 0.18.