CVE-2026-72887

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-72887

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72887.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-72887

Aliases

GHSA-jh72-4qq2-8j6g

Downstream

DEBIAN-CVE-2026-72887

UBUNTU-CVE-2026-72887

Published

2026-08-16T13:50:19.052Z

Modified

2026-08-19T03:31:17.057716416Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token

Details

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken.

Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits oauthcallbackconfirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauthverifier is dropped from the request even when getaccess_token was passed one.

oauth_verifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim's provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider that does not confirm the callback is enough.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "0.32"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "0.32"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cna_assigner": "CPANSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72887.json",
    "cwe_ids": [
        "CWE-757"
    ]
}

References

Affected packages

Git / github.com/vurtdev/net-oauth

Affected ranges

Type

GIT

Repo

https://github.com/vurtdev/net-oauth

Events

Introduced

Fixed

fd505dac1988723ed96721657663f2e4ac731644

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

v0.*

v0.29

v0.30

v0.31

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72887.json"