CVE-2026-72887 affects Net::OAuth::Client versions prior to 0.32 for Perl. The vulnerability is a silent downgrade attack from OAuth 1.0a to OAuth 1.0 during the get_request_token process when the service provider omits the oauth_callback_confirmed parameter. This omission causes the client to drop the oauth_verifier parameter from the access token request, enabling an attacker to exploit OAuth 1.0 session fixation attacks by associating a victim's account with an attacker-controlled session. The CVSS v3.1 score is 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.

An attacker can exploit this vulnerability to perform OAuth 1.0 session fixation attacks, potentially linking a victim's provider account to a session controlled by the attacker. This compromises the security guarantees of OAuth 1.0a, leading to full compromise of the victim's session and associated data. The vulnerability affects confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid using vulnerable versions of Net::OAuth::Client or implement additional controls to detect or prevent OAuth downgrade attacks. Monitoring for updates from the vendor or CPAN security team is recommended.