Net::OAuth EUVD-2026-62350

The attacker must be able to submit arbitrary OAuth-signed requests to the vulnerable endpoint and measure server response latency with sub-millisecond precision - conditions best satisfied from the same datacenter or local network to minimize jitter. Under HMAC-SHA1 and HMAC-SHA256, exploitation recovers only the per-request computed HMAC value, which has limited reuse due to OAuth nonce and timestamp replay protection; the attacker would need to repeat the oracle for each new request. The most severe exploitation path requires the PLAINTEXT signature method to be in active use, which is a non-default, explicitly configured choice - applications that use only HMAC or RSA-SHA1 methods do not expose raw credentials via this oracle. High network jitter environments substantially reduce oracle reliability. RSA-SHA1 signature method users are entirely unaffected regardless of configuration.

The NVD CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) overstates practical exploitability - AC:L is generous for a timing side-channel that requires reliable sub-millisecond measurement across a network link. Real exploitation demands low-jitter, low-latency network conditions and statistical analysis over many requests, making casual mass exploitation unlikely. EPSS at 0.17% (6th percentile) and absence from CISA KEV confirm no observed exploitation at time of analysis. Risk is highly conditional on signature method: PLAINTEXT deployments face the worst outcome (direct secret recovery), while HMAC deployments face a harder oracle attack yielding only a derived HMAC value with limited reuse due to OAuth nonces and timestamps. Overall risk priority is moderate-to-high specifically for applications using the PLAINTEXT method, low-to-moderate for HMAC-only deployments that cannot patch immediately.

An attacker with low-latency access to an OAuth endpoint sends a series of crafted requests varying the signature one byte at a time, measuring server response latency to determine which candidate byte produces the longest matching prefix. Repeating this process across each byte position recovers the full valid signature without brute-forcing the entire space. Under the PLAINTEXT method, the recovered value is directly the consumer_secret and token_secret, enabling the attacker to forge arbitrary authenticated OAuth requests with full credential equivalence.