LiveActive security incident?Get immediate response
CVE Record

CVE-2026-75870: Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key. An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.

CriticalCVSS 9.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Affected Punk applications may accept forged session cookies when sessions are configured without a valid secret. An unauthenticated attacker could create cookies offline that claim another user identity or privileged role, potentially causing account impersonation and unauthorized access without disrupting service.

Executive priority

Treat affected internet-facing or identity-sensitive applications as an immediate remediation priority. Forged sessions could bypass authentication or privilege controls while leaving apparently normal cookies and application behavior. Prioritize version inventory, configuration review, upgrade, secret rotation, and invalidation of existing sessions.

Technical view

Punk versions before 0.18 default an absent, undefined, or empty session secret to a zero-length HMAC-SHA256 key. Both cookie signing and verification use that predictable key. Because the application neither warns nor refuses startup, forged cookies can appear valid and normal session behavior does not reveal the misconfiguration.

Likely exposure

Exposure is limited to Perl applications using Punk before 0.18 that declare sessions without a non-empty secret. Risk is greatest where session contents control authentication, user identity, authorization roles, or other security-sensitive state. The supplied evidence does not quantify affected deployments.

Exploitation context

The CVSS score is 9.1: network-accessible, low complexity, unauthenticated, and requiring no user interaction. An attacker must know the cookie format but can forge cookies offline. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation.

Researcher notes

The vulnerable behavior exists on both cookie read and write paths, producing valid-looking round trips despite the empty key. Exposure therefore depends on configuration, not version alone. The bundle identifies versions before 0.18 as affected but provides no deployment prevalence, proof of exploitation, or evidence that every session stores security-sensitive data.

Mitigation direction

  • Upgrade Punk to version 0.18 or later after reviewing its release notes.
  • Configure every session declaration with a non-empty secret.
  • Rotate any session secret that was absent, undefined, empty, or potentially exposed.
  • Invalidate cookies created while the application used an empty key.
  • Review vendor guidance for any additional remediation requirements.

Validation and detection

  • Inventory Perl applications and identify Punk versions earlier than 0.18.
  • Inspect every session declaration for absent, undefined, or empty secrets.
  • Confirm updated applications reject unsafe session configuration as documented.
  • Verify previously issued session cookies are invalid after remediation.
  • Test that authorization decisions do not trust attacker-controlled session fields.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-1394: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-75870 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.1CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

9.1Critical
CVSS 3.1 vector shape for CVE-2026-75870Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Unknown vendorPunkPunk, 0unaffected
Weakness

CWE details

CWE-1394

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-1394 · source CWE mapping

Use of Default Cryptographic Key

Use of Default Cryptographic Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs