CVE-2026-75589: Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify.
Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two strings differ. The time taken to reject a signature varies with the length of the matching prefix. RSA-SHA1 is not affected, as it verifies through the RSA key object rather than by comparing strings.
A client that can submit messages and time the replies may recover a valid signature one byte at a time rather than searching the whole signature space. Under PLAINTEXT the value compared against is the signature key itself, so the search recovers consumersecret and tokensecret.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net::OAuth (Perl)to a version that resolves this vulnerability.Fixed in 0.33
Event History
Frequently Asked Questions
Which signature methods are affected, and which are not?
HMAC-SHA1, HMAC-SHA256, and PLAINTEXT are affected when verified by versions before 0.33. RSA-SHA1 is not affected because verification is performed through the RSA key object rather than a direct string comparison.
What does an attacker need to exploit this issue?
The attacker needs to be able to submit messages for verification and measure how long replies take. The varying rejection time can let them recover a valid signature one byte at a time.
What is the additional impact when PLAINTEXT signatures are used?
For PLAINTEXT, the compared value is the signature key itself. A successful timing attack can therefore recover the consumer_secret and token_secret.