Net::OAuth CVE-2026-72889

Exploitation requires a Service Provider that uses Net::OAuth (before 0.33) to verify() incoming OAuth 1.0 messages without pinning the signature method - which is every pre-0.33 deployment, since no pinning mechanism existed. The fully-guessable, highest-impact path additionally requires the provider to be deployed on RSA-SHA1: because RFC 5849 RSA-SHA1 does not use consumer_secret/token_secret, those fields are non-secret placeholders that the forged HMAC signature is checked against. Symmetric deployments are still downgradable (HMAC-SHA256 → HMAC-SHA1 → PLAINTEXT) but the attacker must still not know the real shared secret, making that path weaker/harder. Limiting factors: no user interaction and no authentication are needed (PR:N/UI:N), but the trivial key-forgery hinges on the RSA-SHA1 (asymmetric) deployment mode; a symmetric-only provider that keeps its secrets confidential is far less exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) reflects unauthenticated, remote, low-complexity forgery, and the CWE-347 root cause and vendor advisory corroborate a genuine authentication-bypass. However, the signals are mixed: EPSS is very low (0.11%, 2nd percentile), the CVE is not in CISA KEV, and no public PoC is referenced, indicating this is not yet mass-exploited. The most severe, fully-guessable case is conditional - it requires a provider deployed on RSA-SHA1 (or a symmetric-to-weaker downgrade), so real-world impact depends on deployment posture rather than being universal. I also differ from the input on availability: this is a forgery/impersonation flaw, so a C:H/I:H/A:N assessment is more defensible than A:H (see assessed vector). Net: a real and high-severity issue warranting prompt patching for any Net::OAuth Service Provider, but current exploitation pressure is low and the worst case is config-dependent, so it is a high - not emergency - priority absent RSA-SHA1 usage.

An OAuth Service Provider runs Net::OAuth 0.32 configured for RSA-SHA1, holding only each Consumer's public key. An attacker crafts a protected-resource request with oauth_signature_method=HMAC-SHA1 and an HMAC signature computed over the non-secret placeholder consumer_secret, and submits it for any consumer key and token. verify() dispatches on the attacker-chosen method, validates the forged signature, and grants access - no credentials or user interaction required. No public PoC has been identified at time of analysis.