CVE-2026-72887
Description
A flaw was found in Net::OAuth::Client. A malicious service provider can silently downgrade an OAuth 1.0a connection to OAuth 1.0 by omitting the oauth_callback_confirmed parameter in the request token response. This downgrade vulnerability removes the oauth_verifier binding, making the application vulnerable to session fixation. An attacker can then obtain a request token, have the victim authorize it, and complete the exchange, linking the victim's provider account to a session the attacker controls.
Statement
A session fixation vulnerability was found in Net::OAuth::Client for Perl. A malicious service provider can silently downgrade an OAuth 1.0a connection to OAuth 1.0 by omitting the oauth_callback_confirmed parameter in the request token response. This downgrade removes the oauth_verifier binding that OAuth 1.0a added between the authorization step and token exchange. An attacker can obtain a request token, have a victim authorize it, and then complete the exchange themselves, linking the victim's provider account to a session the attacker controls. This vulnerability only affects applications using OAuth 1.0a with callbacks; the library silently revokes the 1.0a protection with no exception or warning.
Mitigation
Update perl-Net-OAuth to version 0.32 or later, which enforces OAuth 1.0a when a callback is configured and prevents silent downgrade. As a workaround, applications can implement additional validation to ensure `oauth_callback_confirmed` is present in request token responses before proceeding with authorization.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
