The vulnerability arises because Punk::OAuth2::Server fails to validate the grant_type and scope in the token request against the client registration. As a result, a client registered with only the authorization_code grant can request client_credentials and obtain a signed access token that carries any scope it names. The server then signs the token and returns it without checking that the requested scope is permitted. This allows an attacker who knows a client identifier to request an access token with arbitrary scopes, yielding full access to a protected resource if the resource server trusts the token.

The affected product is the Perl module Punk::OAuth2::Server, versions through 0.03. The library is maintained on CPAN under the umbrella of LNATION. Clients using any version up to 0.03 are susceptible to the flaw, while upgrading to 0.04 or later removes the issue.

The risk is severe because the flaw permits scope escalation and unauthorized grant type usage without proper authorization checks, an omission classified as CWE‑862. The CVSS score is 9.1, indicating critical severity. An attacker only needs to discover a valid client identifier, which may be public, to obtain a forged token. With an EPSS score of < 1% the risk of exploitation is considered low, but the issue is not listed in the CISA KEV catalog, and the attack vector is highly feasible over the network. An immediate patch is recommended to mitigate the risk.