EUVD-2026-59987Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H because exploitation needs a non-confirming provider outside attacker control, UI:R because the victim must authorize the attacker's request token, A:N as there is no availability impact - only account-linking integrity/confidentiality loss.
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token.
Passing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the request token response omits oauth_callback_confirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauth_verifier is dropped from the request even when get_access_token was passed one.
oauth_verifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim's provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider that does not confirm the callback is enough.
AnalysisAI
Silent OAuth 1.0a-to-1.0 protocol downgrade in the Perl module Net::OAuth::Client (versions before 0.32) lets a service provider strip the anti-session-fixation protection an application explicitly requested. When an app configures a callback (selecting 1.0a) but the provider's request-token response omits oauth_callback_confirmed, get_request_token silently reverts to OAuth 1.0, which drops the oauth_verifier from the access-token exchange with no exception or warning, re-exposing the app to OAuth session fixation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires three concrete preconditions: (1) the target application uses Net::OAuth::Client and passes a callback to new(), selecting OAuth 1.0a; (2) the OAuth service provider it talks to omits oauth_callback_confirmed from its request-token response, which alone triggers the silent downgrade - no attacker action sets it up; and (3) for the session-fixation payoff, the attacker must get the victim to authorize an attacker-obtained request token (required victim interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply and argue against the headline 9.8. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An application built on Net::OAuth::Client requests OAuth 1.0a and connects to a provider that does not return oauth_callback_confirmed, so the library silently falls back to 1.0. An attacker obtains a request token from that provider, lures the victim into authorizing it, then completes the token exchange himself - because oauth_verifier is dropped, nothing distinguishes the attacker's exchange, and the victim's provider account becomes linked to the attacker's session. … |
| Remediation | Vendor-released patch: 0.32 - upgrade Net-OAuth to 0.32 or later (fixing commit fd505dac1988723ed96721657663f2e4ac731644; changelog at https://metacpan.org/release/RRWO/Net-OAuth-0.32/changes). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using Net::OAuth::Client and determine deployed versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today