The vulnerability in Net::OAuth::Client <0.32 arises because the client silently downgrades OAuth 1.0a to OAuth 1.0 if the service provider does not confirm the callback via oauth_callback_confirmed in the request token response. This downgrade disables the use of oauth_verifier, a security binding introduced in OAuth 1.0a, allowing an attacker to exploit session fixation by obtaining a request token, having the victim authorize it, and then completing the token exchange to hijack the victim's session. The downgrade happens without any exception, warning, or option to enforce OAuth 1.0a, making the attack feasible whenever the provider omits the callback confirmation.

Successful exploitation allows an attacker to perform OAuth 1.0 session fixation attacks, potentially linking a victim's OAuth provider account to a session controlled by the attacker. This can lead to unauthorized access and full compromise of the victim's OAuth-protected resources. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should verify the OAuth provider's support for OAuth 1.0a and avoid using Net::OAuth::Client versions before 0.32 with providers that do not confirm the callback. Consider implementing additional application-level checks to detect and prevent OAuth downgrades.