OAuth 1.0 Vulnerability in Net::OAuth::Client for Perl

CVE-2026-72887

What is CVE-2026-72887?

The Net::OAuth::Client library for Perl, specifically versions prior to 0.32, contains a vulnerability that permits the service provider to downgrade OAuth 1.0a requests to OAuth 1.0 without warning. This occurs during the get_request_token process, where a callback indicates an intent to use OAuth 1.0a, but the absence of the oauth_callback_confirmed parameter results in the library treating the request as OAuth 1.0. As a consequence, the oauth_verifier parameter is omitted in subsequent token exchange requests. This flaw can facilitate session fixation attacks, enabling malicious actors to link a victim's account to a session they control by capturing the request token during the authorization process.

References