CVE-2026-72889 Affecting libnet-oauth-perl package, versions <0.33-1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIANUNSTABLE-LIBNETOAUTHPERL-18961478
- published19 Aug 2026
- disclosed19 Aug 2026
Introduced: 19 Aug 2026
CVE-2026-72889 (opens in a new tab)How to fix?
Upgrade Debian:unstable libnet-oauth-perl to version 0.33-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libnet-oauth-perl package and not the libnet-oauth-perl package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify.
verify resolves the signature method class from the signature_method parameter of the incoming message. signature_method is required on every request, so the algorithm used to check a signature is chosen by whoever sent it, and nothing lets the verifying party pin the method instead. When a message names HMAC-SHA1 or HMAC-SHA256, the key is derived from consumer_secret and token_secret rather than from the key the provider deployed.
A provider deployed on RSA-SHA1 holds only the consumer public key, and RFC 5849 does not use consumer_secret for that method, so the required parameter is filled with a placeholder. A client that names HMAC-SHA1 instead has its signature checked against that placeholder, so a guessable one is enough to forge requests for any consumer key and token.
References
- https://security-tracker.debian.org/tracker/CVE-2026-72889
- https://datatracker.ietf.org/doc/html/rfc5849#section-3.4.2
- https://datatracker.ietf.org/doc/html/rfc5849#section-3.4.3
- https://github.com/vurtdev/Net-OAuth/commit/c467adf45c8d77ac4b92ad78b3eebf949252ba7f.patch
- https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-c8rm-g5cm-4pf5
- https://metacpan.org/release/RRWO/Net-OAuth-0.33/changes
- http://www.openwall.com/lists/oss-security/2026/08/19/2