CVE-2026-75589
Low risk· EPSS 6%Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each comparison uses the eq operator, which returns as soon as the strings differ, allowing an attacker to recover a valid signature one byte at a time by timing the replies. Under PLAINTEXT, the compared value is the signature key itself, so the search recovers consumer_secret and token_secret.
Risk Assessment
The risk includes the possibility of recovering OAuth secrets by an attacker, which can lead to unauthorized access to protected resources.
Recommendation
Update Net::OAuth to version 0.33 or later that includes the fix. Review logs for suspicious authentication attempts.
Original NVD description (English source)
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two strings differ. The time taken to reject a signature varies with the length of the matching prefix. RSA-SHA1 is not affected, as it verifies through the RSA key object rather than by comparing strings. A client that can submit messages and time the replies may recover a valid signature one byte at a time rather than searching the whole signature space. Under PLAINTEXT the value compared against is the signature key itself, so the search recovers consumer_secret and token_secret.