THREATOPS

THREAT OPS › Threat News › CVE-2026-75866: Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them

CVE-2026-75866: Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them

medoss_secPublished 2026-08-22

Posted by Timothy Legge on Aug 22======================================================================== CVE-2026-75866 CPAN Security Group ======================================================================== CVE ID: CVE-2026-75866 Distribution: Punk-OAuth2 Versions: through 0.03 <br

Indicators of compromise

CVE-2026-75866cve
https://metacpan.org/dist/Punk-OAuth2url

Original source: https://seclists.org/oss-sec/2026/q3/549

Same event, other sources

[NVD] CVE-2026-75866 — Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registrationvd · 2026-08-22