CVE-2026-15689: Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend.

Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header, or from X-Forwarded-Host under behindproxy (obtained from Dancer2's request->base function). A POST to /login carrying submitreset and a username needs no authentication: it stores a fresh reset code against that account and mails the account holder a link to a host of the sender's choosing. The welcome mail takes the same path when the application calls createuser with emailwelcome set.

Through 0.711 the handlers read request->uribase and request->base directly; Versions 0.712 and later provide an uribase configuration key that defaults to the untrusted request->uribase when unset.

The default configuration with resetpasswordhandler enabled and the default message text, a recipient who follows the link hands a working reset code to the sender's host, which is enough to take over the account.