Threats affecting pkg:cpan/Net-OAuth

Net::OAuth versions before 0.33 for Perl contain a timing side-channel vulnerability in the signature verification process. The library uses non-constant-time string comparisons for HMAC-SHA1, HMAC-SHA256, and PLAINTEXT signatures, allowing an attacker to measure response times and gradually recover valid signatures or secret keys. RSA-SHA1 signatures are not affected. This vulnerability can lead to disclosure of sensitive secrets such as consumer_secret and token_secret.

Net::OAuth versions before 0.33 for Perl contain a critical vulnerability (CVE-2026-72889) where the signature verification algorithm is chosen by the sender, allowing an attacker to forge requests by exploiting improper verification of cryptographic signatures. The flaw arises because the signature_method parameter in incoming messages dictates the verification algorithm without pinning it on the verifier side. This enables attackers to use HMAC-SHA1 or HMAC-SHA256 with a guessable placeholder key, bypassing the intended RSA-SHA1 verification and allowing unauthorized request forgery.

Net::OAuth versions before 0.32 for Perl contain a vulnerability where unbounded caching of failed module loads in the smart_require function can lead to memory exhaustion. This occurs because smart_require stores results in a process-global hash without limits or eviction, including entries for every class name queried, even those that fail to load. A remote client can control the number and length of these entries, causing the hash to grow indefinitely in persistent server processes until memory is exhausted. The vulnerability affects versions prior to 0.32.

Net::OAuth::Client versions before 0.32 for Perl allow a silent downgrade from OAuth 1.0a to OAuth 1.0 during the get_request_token process. This downgrade occurs when the service provider omits the oauth_callback_confirmed parameter, causing the client to revert to OAuth 1.0 without warning or exception. The downgrade results in the omission of the oauth_verifier parameter in the access token request, enabling an OAuth 1.0 session fixation attack. An attacker can obtain a request token, have the victim authorize it, and then complete the token exchange to link the victim's account to a session controlled by the attacker. No attacker action is required to initiate the downgrade other than the provider not confirming the callback.