This critical authentication vulnerability in Net::OAuth::Client allows for OAuth 1.0 session fixation attacks, potentially leading to unauthorized account linking.

The vulnerability occurs in the get_request_token method, where the library fails to enforce OAuth 1.0a when the request token response omits the oauth_callback_confirmed parameter. This allows a service provider to downgrade the security level to OAuth 1.0, which is susceptible to session fixation.

With a CVSS score of 9.8, this vulnerability poses a severe risk to application authentication flows. An attacker can exploit this downgrade to link a victim's provider account to a session controlled by the attacker, leading to unauthorized account access and potential data compromise.

Immediate Action: Update the Net::OAuth::Client library to version 0.32 or later.

Proactive Monitoring: Review application authentication logs for anomalous OAuth callback patterns or unexpected session linking behavior.

Compensating Controls: If immediate patching is not feasible, implement strict validation of OAuth callback responses at the application level to ensure that only OAuth 1.0a flows are accepted.

Public Exploit Available: No confirmed public exploit is available in the available data.

This vulnerability represents a significant risk to the integrity of authentication mechanisms relying on Net::OAuth::Client. Security teams should verify their dependency versions and update to 0.32 or later to eliminate the possibility of protocol downgrade attacks.