Vulnerability in Net::OAuth for Perl Affects Signature Verification

CVE-2026-75589

What is CVE-2026-75589?

The Net::OAuth library for Perl prior to version 0.33 contains a vulnerability in the signature verification process for HMAC-SHA1, HMAC-SHA256, and PLAINTEXT signatures. The vulnerability stems from the use of a non-constant-time comparison method, allowing an attacker to potentially recover valid signatures by timing the responses of the system. This enables the attacker to extract sensitive keys such as consumer_secret and token_secret. It is essential for users to update to version 0.33 or later to mitigate this risk.

References