CVE-2026-15689

Name of the Vulnerable Software and Affected Versions Dancer2::Plugin::Auth::Extensible versions prior to 0.714

Description Password reset link poisoning is possible via the request Host header in the default email password reset and default welcome send functions. Both default emails generate a link using the format $base/login/$code, where the authority is derived from the request Host header or the X-Forwarded-Host header when behind proxy is enabled. An unauthenticated POST request to the '/login' endpoint containing submit reset and a username triggers the storage of a reset code and sends the user a link pointing to a host specified by the attacker. Similarly, the welcome email follows this path when create user is called with email welcome set. In versions through 0.711, handlers read request->uri base and request->base directly, while versions 0.712 and later use an uri base configuration key that defaults to the untrusted request->uri base if unset. If reset password handler is enabled with default message text, a user clicking the link transmits a valid reset code to the attacker's host, enabling account takeover.

Recommendations Update Dancer2::Plugin::Auth::Extensible to a version later than 0.713. Set the uri base configuration key to a trusted value to avoid defaulting to the untrusted request->uri base. Restrict the use of the default email password reset and default welcome send functions until the software is updated.