External risk intelligence

Punk OAuth2 Server Access Token Scope Validation Flaw

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-75866

The product is an OAuth2 authorization server. By design, OAuth2 servers act as central identity and access control gateways, operating as public or perimeter-facing endpoints to facilitate token issuance and authentication for clients and resource servers.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Punk::OAuth2::Server for Perl, which allows access tokens to be issued with scopes and grant types not registered for a specific client. This occurs because the authorization process does not adequately verify these against client registrations, potentially enabling unauthorized access to data.

Unauthorized access tokens can be issued.
Protects core authentication and data access controls.
Confirm relevance and evaluate exposure.

Attack Path

How an attacker could exploit the issue

An attacker can gain unauthorized access to resources by exploiting a flaw in how an OAuth2 server issues access tokens. By registering a client with specific, but insufficient, access rights and then requesting a token for different, broader permissions, an attacker can trick the server into granting access beyond what was intended. This allows the attacker to obtain a token that claims extensive privileges, which are then accepted by resource servers that rely on the token's validity.

No authentication required for client.
Request unauthorized scopes for tokens.
Access protected resources without permission.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a registered client could obtain access tokens that include scopes beyond those it is authorized to use. If a client is registered without a secret, its client ID alone is sufficient to request these tokens. Resource servers that use the Punk::OAuth2::Checker to validate these tokens will honor the excessive scopes, potentially granting unintended access.

Access tokens with unauthorized scopes.
Tokens issued without proper client authentication.
Unauthorized access to protected resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Punk::OAuth2::Server impacts the integrity of access tokens, potentially allowing unauthorized scopes to be granted. Ownership likely falls to the application or platform teams managing the OAuth2 server implementation, with initial steps focusing on inventorying all instances of the affected software, assessing their exposure to unauthenticated clients, and confirming the business criticality of each instance. Coordination with the vendor for updated software or alternative mitigation strategies should follow.

Application or Platform teams own the issue.
Verify instance exposure and criticality.
Coordinate vendor updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Punk::OAuth2::Server?

Punk::OAuth2::Server is a Perl-based software component used to build authorization servers. It handles the core OAuth2 workflow, such as issuing access tokens that allow applications to securely access resources. It manages client registrations, defines what scopes and grant types a client can use, and interfaces with token checkers to maintain access control boundaries.

Why is CVE-2026-75866 considered a vulnerability?

This CVE involves a 'Missing Authorization' weakness (CWE-862). The software fails to verify if a requested access scope or grant type is actually permitted for the specific client requesting it. Because the server ignores these registration checks, it will mint a validly signed token containing arbitrary permissions, essentially allowing a client to grant itself unauthorized levels of access.

How does an attacker trigger this flaw?

An attacker triggers this by requesting a token using a grant type or scope not assigned to their registered client ID. The server processes this request without comparing the input against the client's registered profile. Importantly, the bug is not triggered by legitimate, pre-authorized requests; it specifically manifests when the requested parameters deviate from the client's official registration.

Is my server at risk according to Halo Surface Signal?

Yes, if you run this software, you should treat it as highly relevant. Halo Surface Signal identifies that because Punk::OAuth2::Server functions as an OAuth2 authorization server, it is typically designed to be a perimeter-facing or public-facing gateway. Being inherently network-accessible to facilitate identity services, these instances are generally exposed to external interaction.

What are the first steps to address this issue?

Start by performing an inventory to locate every instance of Punk::OAuth2::Server within your infrastructure. Once identified, evaluate which instances are reachable by untrusted clients, especially those not requiring a client secret. Coordinate immediately with your development or platform teams to prioritize vendor updates or implement interim access controls to mitigate the risk of unauthorized token issuance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.