CVE-2026-72887

A flaw was found in Net::OAuth::Client. A malicious service provider can silently downgrade an OAuth 1.0a connection to OAuth 1.0 by omitting the oauthcallbackconfirmed parameter in the request token response. This downgrade vulnerability removes the oauthverifier binding, making the application...