THREATOPS

THREAT OPS › Threat News › CVE-2026-75870: Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret

CVE-2026-75870: Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret

medoss_secPublished 2026-08-22

Posted by Timothy Legge on Aug 22======================================================================== CVE-2026-75870 CPAN Security Group ======================================================================== CVE ID: CVE-2026-75870 Distribution: Punk Versions: before 0.18

Indicators of compromise

CVE-2026-75870cve
https://metacpan.org/dist/Punkurl

Original source: https://seclists.org/oss-sec/2026/q3/548

Same event, other sources

[NVD] CVE-2026-75870 — Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is abnvd · 2026-08-22