Password Reset Link Poisoning in Dancer2::Plugin::Auth::Extensible by ABEVERLEY

CVE-2026-15689

What is CVE-2026-15689?

The Dancer2::Plugin::Auth::Extensible for Perl is susceptible to a password reset link poisoning issue. Versions up to 0.713 enable malicious actors to exploit the vulnerability by manipulating the Host header in email responses. This can lead to unauthorized access as attackers can craft URLs that direct victims to a host of their choosing, ultimately allowing them to capture valid reset codes. Users following the generated links unknowingly transmit their reset codes, resulting in potential account takeovers. The issue persists due to reliance on untrusted header values for URI construction in the application's email generation processes.

References