Net::OAuth verifies HMAC‑SHA1, HMAC‑SHA256, and PLAINTEXT signatures by comparing the supplied signature string using the Perl eq operator, which exits as soon as a difference is found. Because the verification time grows with the number of matching prefix bytes, an attacker who can reliably measure response latency can perform a timing side‑channel attack, recovering a correct signature one byte at a time. In the PLAINTEXT case the compared data is the secret key itself, allowing the attacker to recover both the consumer_secret and token_secret, which can then be used to forge authenticated requests and compromise credential confidentiality and integrity.

All releases of the Perl module Net::OAuth prior to version 0.33 are affected. Users relying on this library for OAuth verification should verify their installed version and update if necessary.

The CVSS score of 7.5 indicates high severity, while the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low to moderate likelihood of widespread exploitation. Nevertheless, the impact of exposing OAuth secrets is severe. The attack requires only the ability to send crafted requests to the application and observe timing differences, with no need for elevated local privileges. The official fix in Net::OAuth 0.33 replaces the eq comparison with a constant‑time check for all supported signature methods.