The vulnerability arises because Punk::OAuth2::Server fails to validate the grant_type and scope in the token request against the client registration. As a result, a client registered with only the authorization_code grant can request client_credentials and obtain a signed access token that carries any scope it names. The server then signs the token and returns it without checking that the requested scope is permitted. This allows an attacker who knows a client identifier to request an access token with arbitrary scopes, yielding full access to a protected resource if the resource server trusts the token.

The affected product is the Perl module Punk::OAuth2::Server, versions through 0.03. The library is maintained on CPAN under the umbrella of LNATION. Clients using any version up to 0.03 are susceptible to the flaw, while upgrading to 0.04 or later removes the issue.

The risk is severe because the flaw permits scope escalation and unauthorized grant type usage without proper authorization checks, an omission classified as CWE‑862. No CVSS score is provided in the current data, but the vulnerability lends itself to remote exploitation: an attacker only needs to discover a valid client identifier, which may be public, to obtain a forged token. With EPSS not available and the issue not listed in the CISA KEV catalog, the objective exploitation probability remains unknown, though the attack vector is highly feasible over the network. An immediate patch is recommended to mitigate the risk.