CVE-2026-75589

Name of the Vulnerable Software and Affected Versions Net::OAuth versions prior to 0.33

Description The software performs signature verification for HMAC-SHA1, HMAC-SHA256, and PLAINTEXT using a non-constant-time comparison in the verify() function. Specifically, the eq operator is used to compare the message signature against the locally computed one, returning immediately when a difference is found. This allows an attacker to use a timing attack to recover a valid signature one byte at a time by measuring the time taken to reject a signature. In the case of PLAINTEXT signatures, this process can lead to the recovery of the consumer secret and token secret variables.

Recommendations Update Net::OAuth to version 0.33 or later.