Threats Tagged 'cve-2026-72889'

Net::OAuth versions before 0.33 for Perl contain a vulnerability where the signature verification algorithm is chosen by the sender, allowing signature forgery. This improper verification of cryptographic signatures can enable attackers to forge requests by exploiting the way HMAC signatures are validated against a placeholder key. The flaw affects versions prior to 0.33 and has a critical severity rating.

Net::OAuth::Client versions before 0.32 for Perl have a critical vulnerability that allows silent downgrade from OAuth 1.0a to the less secure OAuth 1.0 during the get_request_token process. This downgrade happens without warning when the service provider omits the oauth_callback_confirmed parameter, causing the oauth_verifier parameter to be dropped from the access token request. This enables an attacker to perform OAuth 1.0 session fixation attacks by linking a victim's provider account to a session controlled by the attacker.