Threats Tagged 'cve-2026-72888'

Net::OAuth::Client versions before 0.32 for Perl have a critical vulnerability that allows silent downgrade from OAuth 1.0a to the less secure OAuth 1.0 during the get_request_token process. This downgrade happens without warning when the service provider omits the oauth_callback_confirmed parameter, causing the oauth_verifier parameter to be dropped from the access token request. This enables an attacker to perform OAuth 1.0 session fixation attacks by linking a victim's provider account to a session controlled by the attacker.

Net::OAuth versions before 0.32 for Perl contain a vulnerability that allows memory exhaustion due to unbounded caching of failed module loads in the smart_require function. This occurs because smart_require stores results in a global hash without limits or eviction, including entries for failed loads. A remote client can cause the hash to grow indefinitely in a persistent server process, potentially exhausting memory resources. The vulnerability is related to CWE-770: Allocation of Resources Without Limits or Throttling.