{"id":"CVE-2026-15689","state":"PUBLISHED","title":"Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send","description":"Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send.\n\nBoth default emails emit a link of the form `$base/login/$code`, whose authority comes from the request Host header, or from X-Forwarded-Host under behind_proxy (obtained from Dancer2's request->base function). A POST to /login carrying submit_reset and a username needs no authentication: it stores a fresh reset code against that account and mails the account holder a link to a host of the sender's choosing. The welcome mail takes the same path when the application calls create_user with email_welcome set.\n\nThrough 0.711 the handlers read `request->uri_base` and `request->base` directly; Versions 0.712 and later provide an uri_base configuration key that defaults to the untrusted `request->uri_base` when unset.\n\nThe default configuration with reset_password_handler enabled and the default message text, a recipient who follows the link hands a working reset code to the sender's host, which is enough to take over the account.","publishedAt":"2026-08-15T13:25:26.318Z","updatedAt":"2026-08-17T20:27:51.814Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"CPANSec","products":["ABEVERLEY Dancer2::Plugin::Auth::Extensible"],"affected":[{"vendor":"ABEVERLEY","product":"Dancer2::Plugin::Auth::Extensible","packageName":"Dancer2-Plugin-Auth-Extensible","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.713","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["lib/Dancer2/Plugin/Auth/Extensible.pm"],"programRoutines":[{"name":"Dancer2::Plugin::Auth::Extensible::_default_email_password_reset"},{"name":"Dancer2::Plugin::Auth::Extensible::_default_welcome_send"},{"name":"Dancer2::Plugin::Auth::Extensible::password_reset_send"}],"repo":"https://github.com/PerlDancer/Dancer2-Plugin-Auth-Extensible"}],"references":["https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.711/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L1031-1053","https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.711/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L1097-1121","https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.712/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L178-194","https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.713/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L178-196","https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.713/changes","http://www.openwall.com/lists/oss-security/2026/08/15/4"],"weaknesses":["CWE-640"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/15xxx/CVE-2026-15689.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-15689","state":"PUBLISHED","datePublished":"2026-08-15T13:25:26.318Z","dateUpdated":"2026-08-17T20:27:51.814Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2026-07-14T01:03:59.438Z"},"containers":{"cna":{"title":"Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send","descriptions":[{"lang":"en","value":"Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send.\n\nBoth default emails emit a link of the form `$base/login/$code`, whose authority comes from the request Host header, or from X-Forwarded-Host under behind_proxy (obtained from Dancer2's request->base function). A POST to /login carrying submit_reset and a username needs no authentication: it stores a fresh reset code against that account and mails the account holder a link to a host of the sender's choosing. The welcome mail takes the same path when the application calls create_user with email_welcome set.\n\nThrough 0.711 the handlers read `request->uri_base` and `request->base` directly; Versions 0.712 and later provide an uri_base configuration key that defaults to the untrusted `request->uri_base` when unset.\n\nThe default configuration with reset_password_handler enabled and the default message text, a recipient who follows the link hands a working reset code to the sender's host, which is enough to take over the account."}],"affected":[{"vendor":"ABEVERLEY","product":"Dancer2::Plugin::Auth::Extensible","packageName":"Dancer2-Plugin-Auth-Extensible","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.713","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["lib/Dancer2/Plugin/Auth/Extensible.pm"],"programRoutines":[{"name":"Dancer2::Plugin::Auth::Extensible::_default_email_password_reset"},{"name":"Dancer2::Plugin::Auth::Extensible::_default_welcome_send"},{"name":"Dancer2::Plugin::Auth::Extensible::password_reset_send"}],"repo":"https://github.com/PerlDancer/Dancer2-Plugin-Auth-Extensible"}],"references":[{"url":"https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.711/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L1031-1053"},{"url":"https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.711/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L1097-1121"},{"url":"https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.712/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L178-194"},{"url":"https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.713/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L178-196"},{"url":"https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.713/changes","tags":["release-notes"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-640","description":"CWE-640 Weak Password Recovery Mechanism for Forgotten Password","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2026-08-15T13:25:26.318Z"},"source":{"discovery":"UNKNOWN"},"workarounds":[{"lang":"en","value":"No fixed release is available. In 0.712 and later, set the uri_base configuration key to the application's own base URL; otherwise reject requests whose host is not an expected application hostname, including X-Forwarded-Host under behind_proxy."}],"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/08/15/4"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-08-15T19:06:35.186Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-08-17T20:27:20.766989Z","id":"CVE-2026-15689","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-17T20:27:51.814Z"}}]}}}