CVE-2026-72887

CVE-2026-72887 in the Net::OAuth::Perl library exposes an architectural failure more serious than its CVSS score alone conveys. When you pass a callback URL to initiate OAuth 1.0a authentication, the library is supposed to enforce the oauth_verifier step — the mechanism that prevents session fixation attacks. Instead, if the OAuth provider's response omits the oauth_callback_confirmed field, the library silently drops the oauth_verifier requirement and completes the authentication using the less secure OAuth 1.0 flow. Your application never knows this happened. This is a deliberate inversion of the security model. You explicitly requested OAuth 1.0a by providing a callback. The library overrode that choice without throwing an exception, logging a warning, or providing any API mechanism to detect the divergence. The oauth_verifier is not optional decoration — it is the entire compensation mechanism that makes OAuth 1.0a secure when a provider fails to confirm the callback. By stripping it, the library doesn't merely fail to protect you; it actively breaks the protocol's defense against session fixation. The CVSS 9.8 captures the theoretical severity correctly, but the EPSS of 0.00207 likely reflects the assumption that exploitation requires an active MITM. If a significant fraction of real-world OAuth 1.0 providers passively omit oauth_callback_confirmed, the vulnerable code path triggers automatically — no attacker present. You should investigate which OAuth providers your deployment uses and whether they send oauth_callback_confirmed in their request token responses. Immediate actions: First, identify tokens issued while using this library against any provider that may not confirm callbacks — consider rotating them. Second, if your application passes a callback URL, it should verify that oauth_verifier was actually used in the token exchange, either through library inspection or explicit provider configuration. Third, prefer OAuth 2.0 where possible — OAuth 1.0 was formally deprecated in 2012, and this library is carrying that deprecated code forward as live, exploitable infrastructure. The correct fix is not a warning toggle; it is making the callback-based OAuth 1.0a selection binding — the library should either enforce it or fail explicitly rather than silently downgrade.

Reviewed through automated stages and approved by a human before publication.