CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

CVE-2026-72887

Net::OAuth::Client for Perl is affected in versions before 0.32. The vulnerability allows a service provider to silently downgrade OAuth 1.0a to OAuth 1.0 during get_request_token due to how oauth_callback_confirmed is handled; a provided callback can cause 1.0a to be discarded, and the access to...