Net::OAuth versions prior to 0.33 for Perl perform signature verification for HMAC-SHA1, HMAC-SHA256, and PLAINTEXT using the eq operator, which returns immediately upon detecting a mismatch. This non-constant-time comparison leaks timing information proportional to the length of the matching prefix of the signature. An attacker capable of submitting messages and timing responses can exploit this side channel to recover valid signatures incrementally. The PLAINTEXT signature method is especially critical because the compared value is the signature key itself, enabling recovery of sensitive secrets such as consumer_secret and token_secret. RSA-SHA1 verification is unaffected as it uses RSA key object verification rather than string comparison.

An attacker who can send messages and measure the timing of verification responses may recover valid OAuth signatures one byte at a time. This can lead to disclosure of sensitive secrets, including consumer_secret and token_secret under the PLAINTEXT signature method. The vulnerability compromises confidentiality but does not affect integrity or availability directly.

Upgrade Net::OAuth to version 0.33 or later, where this timing discrepancy vulnerability is fixed. If upgrading is not immediately possible, consider implementing constant-time comparison functions for signature verification to mitigate timing attacks. Patch status is not explicitly stated in the input data, but the affected versions are prior to 0.33, implying that 0.33 or later versions contain the fix.