CVE-2026-72889: Net::OAuth Perl Auth Bypass Vulnerability

CVE-2026-72889 Overview

CVE-2026-72889 affects Net::OAuth versions before 0.33 for Perl. The vulnerability allows the sender of an OAuth message to choose the signature algorithm used during verification. A provider deployed with RSA-SHA1 can be tricked into verifying an HMAC-SHA1 or HMAC-SHA256 signature. Because RFC 5849 does not use consumer_secret with RSA-SHA1, the field is populated with a placeholder that becomes the HMAC key. An attacker who guesses that placeholder can forge signatures for any consumer key and token. The issue is tracked under [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
Attackers can forge valid OAuth signatures for arbitrary consumer keys and tokens on providers deployed with RSA-SHA1, bypassing signature verification entirely.

Affected Products

Net::OAuth for Perl, all versions before 0.33
Any Perl-based OAuth 1.0/1.0a provider using Net::OAuth for signature verification
Providers configured with RSA-SHA1 that rely on verify without pinning the signature method

Discovery Timeline

2026-08-19 - CVE-2026-72889 published to NVD
2026-08-19 - Vulnerability discussed on the Openwall OSS-Security list
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-72889

Vulnerability Analysis

The verify routine in Net::OAuth resolves the signature method class dynamically from the signature_method parameter of the incoming request. RFC 5849 requires signature_method on every request, so the algorithm used to validate the signature is chosen by whoever sends the message. Nothing in the pre-0.33 API lets the verifying party pin the accepted method.

When a message declares HMAC-SHA1 or HMAC-SHA256, the verifier derives the key from consumer_secret and token_secret. Providers deployed on RSA-SHA1 do not store consumer_secret for a given client, because RFC 5849 Section 3.4.3 does not use that field with RSA. Instead, the library fills the required parameter with a placeholder value, and that placeholder becomes the HMAC key.

Root Cause

The root cause is trusting attacker-controlled protocol input to select the verification algorithm. Signature verification must be pinned by the verifying party to the algorithms it deployed. Downgrading from asymmetric RSA-SHA1 to symmetric HMAC allows the sender to complete signing with knowledge that only the verifier should possess, or in this case, with a guessable placeholder.

Attack Vector

An attacker constructs an OAuth 1.0a request against an RSA-SHA1 provider, sets oauth_signature_method to HMAC-SHA1, and computes the signature using the guessable placeholder as the shared secret. The verifier accepts the request for any consumer_key and token the attacker names. See IETF RFC 5849 Section 3.4.2 and Section 3.4.3 for the signature method definitions involved.

text

[Security]
- Restrict the verification algorithm to those specified in the allowed_signature_methods, which is
  now required.  THIS IS A BREAKING CHANGE.

  See https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-c8rm-g5cm-4pf5 (CVE-2026-72889)
  for more information.

Source: GitHub Patch for Net-OAuth. The patch makes allowed_signature_methods mandatory so the verifier states which algorithms are acceptable.

Detection Methods for CVE-2026-72889

Indicators of Compromise

Inbound OAuth 1.0/1.0a requests where oauth_signature_method is HMAC-SHA1 or HMAC-SHA256 on a provider that only issued RSA-SHA1 client credentials.
Successful authentications for oauth_consumer_key values that have never enrolled a shared secret.
Repeated verification attempts from a single source cycling through oauth_consumer_key and oauth_token values.

Detection Strategies

Log the oauth_signature_method parameter for every verified request and alert when it does not match the algorithm registered for the consumer.
Compare the deployed provider configuration against accepted signature methods observed at runtime.
Review application code for calls to Net::OAuth::Request->verify that do not pass allowed_signature_methods.

Monitoring Recommendations

Ingest web server and application logs into a central data lake and normalize OAuth request fields for correlation.
Baseline the signature methods each consumer key legitimately uses, then alert on deviations.
Track library versions in build manifests to flag any deployed Net::OAuth release earlier than 0.33.

How to Mitigate CVE-2026-72889

Immediate Actions Required

Upgrade Net::OAuth to version 0.33 or later from CPAN and rebuild affected services.
Pass allowed_signature_methods to every verify call and set it to the exact algorithm the provider deployed.
Rotate any consumer keys or tokens that may have been used with forged HMAC signatures during the exposure window.

Patch Information

The fix is delivered in Net-OAuth 0.33. The patch, published as commit c467adf45c8d77ac4b92ad78b3eebf949252ba7f, makes allowed_signature_methods a required parameter for verification. This is a breaking change: callers that omit the parameter will fail. See the GitHub Security Advisory GHSA-c8rm-g5cm-4pf5 and the MetaCPAN Net-OAuth Changes for release notes.

Workarounds

If upgrading is not immediately possible, wrap Net::OAuth::Request->verify and reject any request whose signature_method does not match the algorithm expected for the presented consumer_key.
Reject requests at the web tier when oauth_signature_method differs from the provider's deployed method.
Do not store or accept placeholder values for consumer_secret on consumers registered for RSA-SHA1.

bash

# Update Net::OAuth to the fixed release
cpanm Net::OAuth@0.33

# Verify installed version
perl -MNet::OAuth -e 'print $Net::OAuth::VERSION, "\n"'