Punk::OAuth2 library versions prior to 0.03 allow an attacker to specify an off-site redirect after a user logs in. The flaw arises because the same_origin_path function accepts a backslash or tab in the return parameter, which is then normally rejected for other characters. The backslash can be interpreted as a slash, and a preceding tab is stripped before parsing, so the resulting URL points to an external domain. Once the login flow reaches the post‑login redirect step, the user is taken to the attacker’s site without any credentials or tokens being sent.

All deployments of the Punk::OAuth2 Perl library with a version earlier than 0.03. This includes any application that uses the oauth2_login endpoint of Punk::OAuth2 for user authentication and stores the redirect target in the session.

The vulnerability is an open redirect that can be triggered through a crafted URL that the attacker controls. The CVSS score of 5.7 indicates moderate severity, while the EPSS score of < 1% reflects a low probability of exploitation, and it is not listed in CISA’s KEV catalog. Open redirects are frequently used in phishing campaigns to lure users to malicious sites after authentication. The attack likely requires the attacker to supply a URL containing a malicious return parameter, making the primary attack vector social engineering via a link or embedded form. No privilege escalation or code execution is possible, but the redirect can undermine user trust and facilitate credential theft by redirecting to a fake login page.