Net::OAuth versions before 0.33 for Perl allow the sender of a message to specify the signature algorithm used in the verification process via the signature_method parameter. This parameter is required on every request, but the verifying party cannot enforce or pin the expected signature method. When the message specifies HMAC-SHA1 or HMAC-SHA256, the verification key is derived from consumer_secret and token_secret instead of the provider's deployed key. For providers using RSA-SHA1, which relies on the consumer public key and does not use consumer_secret, a placeholder key is used. An attacker can exploit this by naming HMAC-SHA1 in the message, causing the signature to be checked against the placeholder key, which if guessable, allows forging requests for any consumer key and token. This results in improper verification of cryptographic signatures (CWE-347) and potentially incorrect use of cryptographic keys (CWE-757).

An attacker can forge OAuth requests by exploiting the ability to specify the signature algorithm, bypassing the intended cryptographic protections. This can lead to unauthorized access, data manipulation, or other high-impact consequences as the signature verification can be tricked into accepting forged signatures. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability.

No official patch or fix is currently documented. Users should upgrade to Net::OAuth version 0.33 or later once available. Until then, avoid using vulnerable versions or implement strict validation to pin the expected signature method rather than relying on the sender's specified algorithm. Monitor vendor advisories for updates on remediation.