CVE-2026-72889
Description
A flaw was found in Net::OAuth for Perl. A remote attacker can exploit this vulnerability by manipulating the signature algorithm used for verification. By specifying a weaker algorithm, such as HMAC-SHA1 or HMAC-SHA256, in the incoming message, the attacker can force the system to use a potentially guessable key for signature validation. This allows the attacker to forge requests, leading to unauthorized access to resources.
Statement
This vulnerability is rated as Critical severity because an unauthenticated remote attacker can completely bypass authentication without user interaction, permitting arbitrary forged requests against service providers. In Red Hat environments, the affected perl-Net-OAuth package is not part of core Red Hat Enterprise Linux releases and is only delivered via Extra Packages for Enterprise Linux (EPEL) or Fedora repositories. Systems are only exposed if custom or third-party Perl applications explicitly rely on this library to validate incoming OAuth 1.0 protocol messages.
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
