Net::OAuth up to 0.32 Signature verify signature_method weak password hash

Summaryinfo

A vulnerability described as problematic has been identified in Net::OAuth up to 0.32. The affected element is the function verify of the component Signature. Executing a manipulation of the argument signature_method can lead to weak password hash. This vulnerability is tracked as CVE-2026-72889. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Net::OAuth up to 0.32. It has been declared as problematic. This vulnerability affects the function verify of the component Signature. The manipulation of the argument signature_method with an unknown input leads to a weak password hash vulnerability. The CWE definition for the vulnerability is CWE-916. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. As an impact it is known to affect confidentiality. CVE summarizes:

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signature_method parameter of the incoming message. signature_method is required on every request, so the algorithm used to check a signature is chosen by whoever sent it, and nothing lets the verifying party pin the method instead. When a message names HMAC-SHA1 or HMAC-SHA256, the key is derived from consumer_secret and token_secret rather than from the key the provider deployed. A provider deployed on RSA-SHA1 holds only the consumer public key, and RFC 5849 does not use consumer_secret for that method, so the required parameter is filled with a placeholder. A client that names HMAC-SHA1 instead has its signature checked against that placeholder, so a guessable one is enough to forge requests for any consumer key and token.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-72889 since 08/10/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1552.

The vulnerability scanner Nessus provides a plugin with the ID 338045 (Linux Distros Unpatched Vulnerability : CVE-2026-72889), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.33 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (338045). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Net::OAuth

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion