CVE-2026-75870

Name of the Vulnerable Software and Affected Versions Punk versions prior to 0.18

Description Punk for Perl allows session cookie forgery when a session is declared without a secret. The session keyword does not require a secret or issue a warning when one is absent, causing the cookie read and write-back processes to default the key to an empty string. Consequently, the system signs and verifies using a zero-length HMAC-SHA256 key (a Hash-based Message Authentication Code using the SHA-256 hash function). An attacker familiar with the cookie format can create forged cookies offline to manipulate session contents, such as user identifiers or roles, without triggering runtime errors.

Recommendations Update to version 0.18 or later. Ensure a non-empty secret is explicitly provided when declaring sessions to prevent the use of the default empty HMAC key.