Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. Passing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the request token response omits oauth_callback_confirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauth_verifier is dropped from the request even when get_access_token was passed one. oauth_verifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim's provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider t
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Net::OAuth::Client versions before 0.32 contain a critical silent downgrade vulnerability that allows service providers to force OAuth 1.0 fallback from the more secure OAuth 1.0a specification. When a callback parameter is passed to the constructor, the library correctly initializes OAuth 1.0a, but if the service provider's response omits the oauth_callback_confirmed field, the library silently downgrades without raising exceptions, warnings, or offering enforcement options. This downgrade strips the oauth_verifier parameter during the access token request phase, eliminating a crucial security control designed to prevent authorization code interception attacks. Organizations using vulnerable versions of this Perl module in applications that handle OAuth authentication are at risk, particularly those integrating with third-party OAuth providers or building OAuth service implementations.
Casky's skill mapping to MITRE ATT&CK would identify this vulnerability through detection of authentication bypass patterns and protocol manipulation techniques. While this CVE lacks direct MITRE technique attribution, practitioners using Casky's security skills would identify attack patterns consistent with T1556 (Modify Authentication Process) and T1187 (Forced Authentication) by analyzing code flow analysis capabilities. The platform's extended reasoning would flag suspicious patterns where OAuth negotiation silently accepts weaker security parameters, authentication tokens lack expected verifier components, and service provider responses fail validation without triggering alerts. Practitioners reviewing Casky findings would see anomalies in OAuth handshake sequences where callback confirmation fields are missing, access token requests lack verifier parameters despite initial 1.0a negotiation, and no defensive logging occurs during protocol downgrade—all indicators of exploitation or misconfiguration that warrant immediate remediation through library updates.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-72887. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation