CVE-2026-72887

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...