Net::OAuth versions prior to 0.33 for Perl perform signature verification using the eq operator, which returns immediately upon detecting a mismatch. This non-constant-time comparison leads to observable timing discrepancies that vary with the length of the matching prefix of the signature. An attacker able to submit messages and measure response times can exploit this to recover valid signatures incrementally. The vulnerability affects HMAC-SHA1, HMAC-SHA256, and PLAINTEXT signature methods, but not RSA-SHA1, which uses a different verification approach. Under PLAINTEXT, the timing attack can reveal the consumer_secret and token_secret values.

An attacker capable of sending crafted messages and measuring response times can exploit the timing discrepancy to recover valid OAuth signatures one byte at a time. This can lead to disclosure of sensitive secrets such as consumer_secret and token_secret, potentially allowing unauthorized access or impersonation within systems relying on Net::OAuth for authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider mitigating risk by avoiding use of vulnerable signature methods (HMAC-SHA1, HMAC-SHA256, PLAINTEXT) or implementing additional protections such as rate limiting or network-level controls to reduce the feasibility of timing attacks.