This vulnerability (CVE-2026-75870) affects Punk versions prior to 0.18 for Perl. When a session is declared without specifying a secret, the session keyword uses an empty string as the default HMAC key for signing and verifying cookies. Because the system neither requires nor warns about the missing secret, cookies are signed with a zero-length HMAC-SHA256 key. An attacker who knows the cookie format can forge session cookies offline, potentially impersonating users or escalating privileges by injecting arbitrary session data. The misconfiguration is not detectable at runtime since cookies appear well-formed and sessions function normally.

An attacker can forge session cookies with arbitrary contents, such as user identifiers or roles, enabling potential unauthorized access or privilege escalation. The vulnerability arises from the use of a default empty cryptographic key, which effectively disables the integrity protection of session cookies. There is no runtime indication of the misconfiguration, making detection difficult.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that a strong secret is always explicitly configured when declaring sessions to avoid the use of the empty default HMAC key. Avoid running vulnerable versions without specifying a secret to prevent session cookie forgery.