Executive brief
Punk::OAuth2 is a Perl library that implements OAuth 2.0 login functionality. A validation bypass flaw allows attackers to craft a malicious login link that, after a user authenticates successfully, redirects them to an attacker-controlled website. This breaks user trust and could be leveraged for phishing attacks or credential theft.
Technical details
The vulnerability is an open redirect in the same_origin_path validation function. The code reads a return parameter from the login initiation request and validates it to ensure the post-login redirect is to the same origin. However, the validation function rejects values with a leading non-slash, double-slash at position 2, or CR/LF characters, but fails to reject backslashes and tab characters. The URL Standard treats backslashes as equivalent to forward slashes in special schemes (e.g., /\evil.example is parsed as //evil.example), and it strips ASCII tabs before parsing. An attacker can craft a link containing /\attacker.com or /[tab]/attacker.com that passes validation and redirects authenticated users off-site. The redirect carries no authorization code or token, limiting secondary exploitation but enabling phishing and trust abuse. Versions before 0.03 are affected; patches are available in 0.03 and later.
Affected products
- Punk OAuth2 before 0.03
Timeline
- 2026-08-20: disclosed