CVE-2026-72887
Received Received - Intake

OAuth 1.0 Downgrade in Net::OAuth::Client

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: CPANSec

Description
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. Passing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the request token response omits oauth_callback_confirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauth_verifier is dropped from the request even when get_access_token was passed one. oauth_verifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim's provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider that does not confirm the callback is enough.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-72887
EUVD
EUVD-2026-59987

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vurtdev net_oauth_client to 0.32 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-757 A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a silent downgrade from OAuth 1.0a to OAuth 1.0 in Net::OAuth::Client versions before 0.32. When a callback is configured, the library selects OAuth 1.0a, but if the service provider omits the oauth_callback_confirmed parameter, it silently falls back to OAuth 1.0 without warning. This causes the oauth_verifier parameter to be dropped during the access token request, enabling session fixation attacks where an attacker can link their account to a victim's session.

Detection Guidance

To detect this vulnerability, inspect Perl applications using Net::OAuth::Client versions before 0.32. Check for OAuth 1.0a downgrades by monitoring for missing oauth_callback_confirmed parameters in request-token responses. Review logs for dropped oauth_verifier parameters during access-token requests.

Impact Analysis

This vulnerability allows an attacker to perform session fixation attacks. An attacker can initiate an OAuth flow, trick a victim into authorizing the attacker's request token, and then complete the token exchange themselves without the verifier. This could lead to unauthorized access to the victim's account or linking the attacker's account to the victim's session.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to the risk of unauthorized session fixation attacks. OAuth 1.0a session fixation may lead to unauthorized access to protected user data, which could result in data breaches. GDPR requires protection of personal data and breach notification, while HIPAA mandates safeguards for protected health information. The silent downgrade to OAuth 1.0 removes critical security measures like the oauth_verifier, increasing exposure to such attacks.

Mitigation Strategies

Upgrade Net::OAuth::Client to version 0.32 or later. If upgrading is not possible, configure applications to explicitly handle OAuth 1.0a downgrades or disable OAuth 1.0a fallback. Monitor OAuth flows for unexpected parameter drops or downgrades.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart