CVE-2026-75870

CVE-2026-75870 affects the Punk Perl web framework (by LNATION) in versions before 0.18 . When the session keyword is declared without a secret option (or with an undefined/empty one), both cookie read and write-back default the HMAC key to an empty string , resulting in a zero-length HMAC-SHA256...

Ping Identity: Session misconfiguration on forget password feature at https://ort-admin.pingone.com

Summary: After looking into session related bugs , i can see that Session misconfiguration on forget password feature at https://ort-admin.pingone.com Steps To Reproduce: 1 go to https://ort-admin.pingone.com and login as user-A in browser-A 2 go to https://ort-admin.pingone.com and click on forg...

Ping Identity: Session misconfiguration on change password feature at https://apps-staging.pingone.com/myaccount/?environmentId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx#

Summary: After loooking into session related issue , i can see that there is session misconfiguration on change password feature at https://apps-staging.pingone.com Steps To Reproduce: 1 go to https://apps-staging.pingone.com/myaccount/?environmentId=XXXXX and login as user-A in browser-A 2 go to...