CVE-2026-75866— Perl Punk::OAuth2::Server 0.03 访问令牌越权漏洞
一分钟漏洞结论
影响对象
CVE-2026-75866
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Punk::OAuth2::Server（Perl 模块，版本 0.03 及更早版本）存在漏洞，允许访问令牌（access tokens）超出客户端已注册的 scopes（权限范围）和 grant_types（授权类型），原因是缺乏对这些字段的有效授权路径校验。 在 Punk::OAuth2::Server::Store 中，每个客户端的 scopes 和 grant_types 均被分别注册，并在客户端注册信息中予以记录。令牌分发逻辑基于请求体中的 grant_type 进行，因此，一个仅注册了 authoriz
可能的 ATT&CK 技术 1 AI
T1078 · Valid Accounts一、 漏洞 CVE-2026-75866 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them
来源: CVE Program / CVE List V5
Vulnerability Description
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them.
Punk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token dispatches on the grant_type in the request body, so a client registered for authorization_code alone can ask for client_credentials, and that arm passes the requested scope straight to the minter, which signs it into the at+jwt access token. authorize copies the query scope into the authorization code record without comparing it against the registration, leaving the optional consent hook as the only check between an arbitrary scope and the issued code. redirect_uris on the same client row is read and enforced.
A registered client can obtain a correctly signed token carrying any scope it names, and a resource server running Punk::OAuth2::Checker accepts that token and honours the scope. A client registered without a secret authenticates on its client_id alone, so anyone who knows that identifier can request one.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| - | - | 0 ~ 0.03 | - |
|
二、漏洞 CVE-2026-75866 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-75866 的情报信息
请登录查看更多情报信息。
CVE-2026-75866 补丁与修复 (1)
-
🔗 Changes - metacpan.org release-notes
CVE-2026-75866 其他参考 (1)
-
🔗 Punk::OAuth2::Server::Store - DBI storage for the authorization server - metacpan.org technical-description
IV. Related Vulnerabilities
V. Comments for CVE-2026-75866
暂无评论