CVE-2026-75628

Name of the Vulnerable Software and Affected Versions Punk::OAuth2 versions prior to 0.03

Description An issue exists where an attacker can force an off-site redirect after login. This occurs because the same origin path function incorrectly accepts backslashes or tabs in the return parameter. The oauth2 login function processes the return parameter from the initiation request using same origin path and stores the result as the post-login redirect target. While the check rejects values that do not start with a slash, have a slash as the second byte, or contain carriage return (CR) or line feed (LF) characters, it allows backslashes and tabs. According to the URL Standard, a backslash can be treated as a slash, and ASCII tabs are stripped before parsing, allowing a crafted link to redirect a victim to an external site after successful authentication. This redirect does not expose authorization codes or access tokens.

Recommendations Update to version 0.03 or later.