CVE-2026-72887

Name of the Vulnerable Software and Affected Versions Net::OAuth::Client versions prior to 0.32

Description Net::OAuth::Client allows a service provider to silently downgrade OAuth 1.0a to OAuth 1.0 within the get request token() function. When a callback is passed to the constructor, OAuth 1.0a is selected; however, if the request token response omits oauth callback confirmed, this choice is revoked without warning or exception. Consequently, the access token request is constructed using the OAuth 1.0 message class, which lacks a verifier parameter, causing the oauth verifier variable to be dropped even if provided to get access token(). The oauth verifier serves as the binding between the authorization step and the token exchange in OAuth 1.0a. This flaw exposes applications to OAuth 1.0 session fixation, enabling an attacker to obtain a request token, induce a victim to authorize it, and complete the exchange to link the victim's provider account to a session controlled by the attacker. This downgrade can occur simply if a provider does not confirm the callback.

Recommendations Update to version 0.32 or later.