CVE-2026-75866: CWE-862 Missing Authorization

Punk::OAuth2::Server versions through 0.03 have a missing authorization path that fails to verify requested scopes and grant types against those registered per client. The server registers scopes and grant_types per client, but token issuance dispatches based on the grant_type in the request body without validating it against the client's registration. The authorize function copies requested scopes into the authorization code without comparing them to registered scopes, relying only on an optional consent hook. Consequently, a registered client can obtain a signed access token carrying any scope it requests. Clients without secrets authenticate using only their client_id, allowing unauthorized token requests by anyone who knows the client_id. Resource servers using Punk::OAuth2::Checker accept and honor these tokens, leading to potential unauthorized access.

An attacker who knows a client_id can request access tokens with arbitrary scopes and grant types beyond those registered, potentially gaining unauthorized access to protected resources. The vulnerability allows elevation of privileges and unauthorized resource access without requiring client secrets or user consent enforcement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict knowledge of client_ids and consider additional access controls on resource servers to validate token scopes. Monitor for updates from the vendor or maintainers of Punk::OAuth2::Server for official patches or mitigations.