CVE-2026-72889

Name of the Vulnerable Software and Affected Versions Net::OAuth versions prior to 0.33

Description In the verify() function, the software allows the sender to specify the signature algorithm via the signature method parameter of the incoming message. Because the verifying party cannot pin a specific method, the sender controls the algorithm used for signature verification. When HMAC-SHA1 or HMAC-SHA256 is specified, the key is derived from consumer secret and token secret instead of the provider's deployed key. In environments deployed with RSA-SHA1, which only hold the consumer public key, the required parameter is filled with a placeholder. An attacker specifying HMAC-SHA1 can have their signature checked against this placeholder, potentially allowing the forgery of requests for any consumer key and token if the placeholder is guessable.

Recommendations Update to version 0.33 or later.