The flaw in Net::OAuth versions before 0.33 allows an attacker to specify the signature algorithm in the signature_method parameter during OAuth request verification. Because the method is taken from the request and not constrained by the server, the verification code uses a placeholder key when HMAC‑SHA1 or HMAC‑SHA256 is chosen, even for a provider that is configured to use RSA‑SHA1. This causes the verifier to accept a forged signature created with a guessable key, effectively allowing the attacker to forge authenticated requests for any consumer key and token. The result is a complete bypass of OAuth authentication, providing attackers the ability to create or modify resources, read sensitive data, or abuse the service. This flaw is a CWE‑347 and CWE‑757 vulnerability.

Any Perl application that imports the Net::OAuth CPAN module and validates OAuth requests using a version earlier than 0.33 is affected. The vulnerability is limited to the library; it does not require a particular web server or operating system, but any system that relies on Net::OAuth for OAuth verification without the patch is susceptible.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a relatively low likelihood of exploitation at present. Nevertheless, the impact of a successful exploit is high, as an attacker can forge authenticated requests with any consumer key and token. The attack vector is remote; an adversary only needs to send a crafted OAuth request over the network, and no special credentials or local code execution are required. The CVSS score is 9.8, confirming the high severity of this flaw.