EUVD-2026-59758
GHSA-gmj3-5xfg-q3qg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network POST against default config (PR:N/AC:L), but the account holder must click the poisoned link so UI:R; account takeover gives C:H/I:H while availability is not directly impacted (A:N).
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
4DescriptionCVE.org
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send.
Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header, or from X-Forwarded-Host under behind_proxy (obtained from Dancer2's request->base function). A POST to /login carrying submit_reset and a username needs no authentication: it stores a fresh reset code against that account and mails the account holder a link to a host of the sender's choosing. The welcome mail takes the same path when the application calls create_user with email_welcome set.
Through 0.711 the handlers read request->uri_base and request->base directly; Versions 0.712 and later provide an uri_base configuration key that defaults to the untrusted request->uri_base when unset.
The default configuration with reset_password_handler enabled and the default message text, a recipient who follows the link hands a working reset code to the sender's host, which is enough to take over the account.
AnalysisAI
Password reset link poisoning in the Perl module Dancer2::Plugin::Auth::Extensible (all versions through 0.713) lets an unauthenticated remote attacker trigger a genuine reset email whose link points to an attacker-chosen host, enabling account takeover. Because the reset link's authority is built from the untrusted request Host header (or X-Forwarded-Host under behind_proxy), a victim who clicks hands a valid reset code to the attacker's server. There is no public exploit identified at time of analysis; EPSS is low (0.28%, 21st percentile) and CISA SSVC lists exploitation as none, but the flaw is marked automatable with total technical impact.
Technical ContextAI
The affected component is a CPAN authentication plugin for the Dancer2 Perl web framework, providing login, password-reset and welcome-email flows. The root cause is CWE-640 (Weak Password Recovery Mechanism): the _default_email_password_reset and _default_welcome_send handlers construct the reset URL as $base/login/$code, where $base is derived from Dancer2's request->base / request->uri_base - values populated from the client-controlled Host header (or X-Forwarded-Host when behind_proxy is set). Through 0.711 the handlers read request->uri_base and request->base directly with no allowlist; 0.712 and 0.713 add an uri_base configuration key, but it still defaults to the untrusted request->uri_base when the operator does not set it, so default deployments remain exposed. This is a classic host-header injection into a security-sensitive out-of-band token delivery channel.
RemediationAI
No fully patched release is confirmed in the provided data - 0.713 is still listed as vulnerable - so the primary action is a configuration hardening: on 0.712 or later, explicitly set the plugin's uri_base configuration key to a trusted, hard-coded absolute base URL rather than leaving it to default to the untrusted request->uri_base; this pins the reset/welcome link authority regardless of the incoming Host header. Where behind_proxy is used, ensure the reverse proxy strips or normalizes client-supplied X-Forwarded-Host and only forwards a trusted value. As additional compensating controls, override the default password-reset and welcome message templates so links are built from a static configured hostname (trade-off: you lose the stock templates and must maintain your own), and enforce a Host-header allowlist at the web server or load balancer so requests with unexpected Host values are rejected (trade-off: must be updated when legitimate hostnames change, and can break multi-tenant vhosts). Track the vendor changelog (https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.713/changes) for a version that changes the uri_base default to a safe value.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today