{"id":"CVE-2026-75628","revision":"000bca0ee659485f9dd8b2cc1c610e3f","records":[{"revision":"000bca0ee659485f9dd8b2cc1c610e3f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-75628","aliases":[],"title":"Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter","description":"Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter.\n\noauth2_login reads the return parameter from the initiation request, runs same_origin_path over it, and stores the survivor in the session flow record as the post-login redirect target. That check rejects a value that does not begin with a slash, one with a slash as its second byte, and one containing CR or LF. A backslash and a tab pass. The URL Standard treats a backslash as equivalent to a slash for special schemes, so `/\\evil.example` parses with the authority `evil.example`. It also strips ASCII tab before parsing, so a tab between two leading slashes leaves `//evil.example`.\n\nA crafted link to the application's own login route lands the victim on the attacker's site after a genuine authentication. The redirect carries no authorization code or access token.","state":0,"publishedAt":"2026-08-20T00:40:08.22+00:00","modifiedAt":"2026-10-19T21:19:28.7+00:00","affected":[{"ecosystem":"https://cpan.org/modules","name":"Punk-OAuth2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://cpan.org/modules\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"Punk::OAuth2\"\n                    ],\n                    \"packageName\": \"Punk-OAuth2\",\n                    \"packageURL\": \"pkg:cpan/Punk-OAuth2\",\n                    \"programFiles\": [\n                        \"include/pox/pox_util.h\",\n                        \"lib/Punk/Plugin/OAuth2.pm\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Punk::OAuth2::same_origin_path\"\n                        }\n                    ],\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"0.03\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://metacpan.org/release/LNATION/Punk-OAuth2-0.03/changes","https://metacpan.org/release/LNATION/Punk-OAuth2-0.02/source/include/pox/pox_util.h#L94","https://datatracker.ietf.org/doc/html/rfc9700#section-4.11.1","https://url.spec.whatwg.org/#relative-slash-state","https://url.spec.whatwg.org/#concept-basic-url-parser"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-75628","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-75628","identifiers":["CVE-2026-75628"]},"retained":false,"historicalAffected":[]}],"coverage":[]}