Punk versions before 0.18 use an empty default HMAC key when a session is declared without a secret. When the secret option is omitted or set to an empty value, the session cookie is signed and verified with a zero‑length HMAC‑SHA256 key. An attacker who understands the cookie format can create a forgery that contains any desired session data, such as a user identifier or role, and the application will accept it as valid. This breaks the integrity of the session and allows an attacker to impersonate any user or elevate privileges without detection at runtime.

The vulnerability affects the Punk web framework distributed through CPAN. Versions prior to 0.18 of the Punk module in Perl are impacted. Deployments using the Punk module without a configured session secret, or with an empty secret, are subject to cookie forgery.

The EPSS score is <1%, and the CVSS score is 9.1, indicating a critical severity. The vulnerability is not listed in the CISA KEV catalog. The lack of a runtime warning or startup error allows attackers to generate compliant cookies offline and use them in remote HTTP requests to the affected application. The likely attack vector is a remote network request where the attacker supplies a forged cookie. Because the flaw permits arbitrary session state creation, the risk is high for privilege escalation and unauthorized access when the application cannot verify the authenticity of session data.