The vulnerability in Net::OAuth versions prior to 0.33 arises from improper verification of cryptographic signatures (CWE-347). The verify function resolves the signature method class based on the signature_method parameter of the incoming message, which is controlled by the sender. This design flaw allows an attacker to specify a weaker signature method (e.g., HMAC-SHA1) even when the provider expects RSA-SHA1. Because RSA-SHA1 verification uses only the consumer public key and does not rely on consumer_secret, the placeholder key used for HMAC methods can be guessed. Consequently, an attacker can forge valid signatures for any consumer key and token, bypassing authentication.

An attacker can forge OAuth requests by exploiting the ability to choose the signature verification algorithm, bypassing the intended cryptographic protections. This undermines the authentication mechanism, potentially allowing unauthorized access or actions under any consumer key and token.

No official patch or remediation has been confirmed yet. Users should check the vendor advisory for updates. Until a fix is available, avoid using vulnerable versions of Net::OAuth (versions before 0.33) in security-critical environments or implement additional verification to enforce the expected signature method.