The Net::OAuth::Client module for Perl, prior to version 0.32, silently allows an OAuth provider to downgrade an OAuth 1.0a flow to OAuth 1.0 by ignoring the oauth_callback_confirmed flag. This omission causes the access‑token request to be built without the verifier parameter that binds the authorization step to the token exchange. An attacker who obtains a request token and can have a user authorize it can then complete the exchange themselves, linking the victim’s provider account to the attacker’s session and enabling credential theft and impersonation.

This vulnerability affects deployments of the Net::OAuth::Client Perl module, versions earlier than 0.32. The module is distributed via CPAN and maintained by the vurtdev community on GitHub.

The flaw carries high risk because it requires no attacker action beyond using a provider that does not enforce callback confirmation; many providers may unintentionally allow this downgrade. The CVSS score of 9.8 and EPSS score of < 1% indicate a critical severity with low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, yet the simplicity of the attack path makes it readily exploitable. Administrators should therefore treat it as a significant threat that can lead to session fixation and credential compromise.