Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75870— Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret

Quick assessment

Affected
CVE-2026-75870
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Punk 模块在 0.18 版本之前存在会话Cookie伪造漏洞。当会话未设置秘密密钥（secret）时，由于默认使用了空的HMAC密钥，攻击者可伪造会话Cookie。 具体而言， 关键字会将其配置选项直接应用于应用程序，且不会强制要求提供秘密密钥，也不会因缺少密钥而发出警告或拒绝启动。在读取和写入Cookie时，该密钥默认会被设置为空字符串。因此，如果在会话声明中未指定secret选项，或将其设为未定义或空值，系统实际上会使用一个零长度的 HMAC-SHA256 密钥进行签名和验证。 一旦攻击者了解

AI Predicted 5.3 Difficulty: Easy EPSS 0.20% · P10

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 0.18 affected

I. Basic Information for CVE-2026-75870

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret
Source: CVE Program / CVE List V5
Vulnerability Description
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key. An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1394
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.18 -

II. Public POCs for CVE-2026-75870

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75870

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-75870 (1)

Other References for CVE-2026-75870 (2)

IV. Related Vulnerabilities

Same weakness: CWE-1394

V. Comments for CVE-2026-75870

No comments yet

Leave a comment