CVE-2026-75589

Deferred Deferred - Pending Action

Timing Attack in Net::OAuth Perl Library

Publication date: 2026-08-19

Last updated on: 2026-08-26

Assigner: CPANSec

Description

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two strings differ. The time taken to reject a signature varies with the length of the matching prefix. RSA-SHA1 is not affected, as it verifies through the RSA key object rather than by comparing strings. A client that can submit messages and time the replies may recover a valid signature one byte at a time rather than searching the whole signature space. Under PLAINTEXT the value compared against is the signature key itself, so the search recovers consumer_secret and token_secret.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-75589

EUVD

EUVD-2026-62350

Affected Vendors & Products

Vendor	Product	Version / Range
vurtdev	net-oauth	to 0.33 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Net::OAuth Perl package versions before 0.33. It involves using the built-in equality operator (eq) for comparing HMAC signatures, which is vulnerable to timing attacks. Attackers can measure the time taken for signature comparisons to infer security-relevant information, such as valid signatures.

Detection Guidance

To detect this vulnerability, check if your system uses Net::OAuth Perl package versions prior to 0.33. Run the command: perl -MNet::OAuth -e 'print $Net::OAuth::VERSION' to verify the installed version. If the output is less than 0.33, the system is vulnerable.

Impact Analysis

An attacker could exploit this to recover valid signatures one byte at a time, potentially exposing consumer secrets and token secrets. This could lead to unauthorized access to protected resources or data if the signatures are used for authentication or authorization.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may fail to protect personal or health information adequately, risking compliance breaches and legal penalties.

Mitigation Strategies

Immediately update the Net::OAuth Perl package to version 0.33 or later. Use the command: cpanm Net::OAuth to upgrade. If upgrading is not possible, consider disabling HMAC-SHA1, HMAC-SHA256, and PLAINTEXT signature verification methods as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-75589. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70