CVE-2026-75866

Name of the Vulnerable Software and Affected Versions Punk::OAuth2::Server versions prior to 0.04

Description The software issues access tokens that exceed a client's registered scopes and grant types because the authorization path fails to validate them. Specifically, the token function dispatches based on the grant type in the request body without verifying if the client is registered for that type; for example, a client registered only for authorization code can request client credentials. In such cases, the requested scope is passed directly to the minter and signed into the at+jwt access token. Additionally, the authorize function copies the query scope into the authorization code record without comparing it against the registration, relying solely on an optional consent hook. Consequently, a registered client can obtain a signed token with any specified scope, which is then honored by a resource server using Punk::OAuth2::Checker. Furthermore, clients registered without a secret can authenticate using only their client id, allowing anyone with that identifier to request tokens.

Recommendations Update Punk::OAuth2::Server to a version newer than 0.03.