{"id":"CVE-2026-75628","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-75628","generatedAt":"2026-10-28T03:25:51.278Z","title":"Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter. oauth2_login reads the return parameter from the initiation request, runs…","description":"Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter.\n\noauth2_login reads the return parameter from the initiation request, runs same_origin_path over it, and stores the survivor in the session flow record as the post-login redirect target. That check rejects a value that does not begin with a slash, one with a slash as its second byte, and one containing CR or LF. A backslash and a tab pass. The URL Standard treats a backslash as equivalent to a slash for special schemes, so `/\\evil.example` parses with the authority `evil.example`. It also strips ASCII tab before parsing, so a tab between two leading slashes leaves `//evil.example`.\n\nA crafted link to the application's own login route lands the victim on the attacker's site after a genuine authentication. The redirect carries no authorization code or access token.","published":"2026-08-20T01:16:54.000Z","lastModified":"2026-10-27T10:10:00.000Z","status":"Deferred","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","cvss":{"version":"3.1","score":5.7,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"},"cwe":["CWE-601"],"affected":[],"epss":{"score":0.00503,"percentile":0.42738,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.50%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://datatracker.ietf.org/doc/html/rfc9700#section-4.11.1","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/LNATION/Punk-OAuth2-0.02/source/include/pox/pox_util.h#L94","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/LNATION/Punk-OAuth2-0.03/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://url.spec.whatwg.org/#concept-basic-url-parser","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://url.spec.whatwg.org/#relative-slash-state","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/20/1","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-75628","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}