Executive brief
Punk::OAuth2::Server is a Perl library that implements OAuth 2.0 authorization services. The library fails to validate that client applications can only request access tokens within their registered scopes and grant types, allowing an attacker to obtain tokens with arbitrary permissions. A client registered without a secret can be impersonated by knowing only the client identifier, further widening the attack surface.
Technical details
The vulnerability is an authorization bypass in OAuth 2.0 scope and grant-type enforcement. The token endpoint dispatches on the grant_type from the request body without validating it against the client's registered grant types, and the authorization endpoint copies the requested scope into the authorization code record without comparing it against registered scopes. The optional consent hook is the only check between an arbitrary scope and issuance. Additionally, clients registered without a secret authenticate on client_id alone, enabling client impersonation. A resource server using Punk::OAuth2::Checker will accept and honor these incorrectly-scoped tokens. No patch information is currently available.
Affected products
- Punk OAuth2::Server through 0.03
Timeline
- 2026-08-22: disclosed