The vulnerability in Punk::OAuth2 (pre-0.03) arises because the same_origin_path function accepts backslash and tab characters in the return parameter, which bypasses intended origin checks. Since the URL Standard treats backslashes as slashes and strips ASCII tabs before parsing, crafted return URLs like `/\evil.example` or URLs with tabs can redirect users to attacker-controlled domains after login. The redirect occurs post-authentication but does not leak authorization codes or tokens.

An attacker can craft a login URL that, after successful authentication, redirects the user to an attacker-controlled site. This can facilitate phishing attacks or other social engineering exploits. No direct compromise of credentials or tokens is indicated.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of login URLs and avoid clicking suspicious links. Developers should consider validating and sanitizing redirect parameters more strictly to reject backslash and tab characters.